Splunk Exam SPLK-1002 Topic 11 Question 109 Discussion

When creating an event type in Splunk, subsearches are allowed in the search string. Subsearches enable users to perform a secondary search whose results are used as input for the main search. This functionality is useful for more complex event type definitions that require additional filtering or criteria based on another search.

Splunk Docs: About subsearches

Splunk Docs: Event type creation

Splunk Answers: Using subsearches in event types