A subsearch is a Splunk search that uses a search pipeline as the argument. Subsearches in Splunk are contained in square brackets and evaluated first. Think of a subsearch as being similar to a SQL subquery (a subquery is a SQL query nested inside a larger query).
Subsearches are mainly used for three purposes:
Generally, you use a subsearch to take the results of one search and use them in another search, all in a single Splunk search ...