Splunk Search

Rename as Search vs Rename as Query?

Glasses
Builder

Hi
I need a little clarification as the related posts I have found are confusing.

I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

Does rename as query give you all the results in the next phase of the query?

Thank you

Tags (2)
0 Karma

solarboyz1
Builder

a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query

Something like:

search [ search | rename field as search_field ]

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:

search [ search | rename field as search_field | fields search_field  ]

Does rename as query give you all the results in the next phase of the query?

Correct, a rename should not filter any results

0 Karma

Glasses
Builder

Thank you for the reply.

Sorry, I should clarify... this is what I meant...

search ... [search ... | rename <somefield> as search]

vs.

search ... [search ... | rename <somefield> as query]
0 Karma

solarboyz1
Builder

Right, it really doesn't matter what the new field name's are...rename does not filter events.

0 Karma

Glasses
Builder

we might not be thinking about the same thing...

I was referring to the topic in this post...

https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...