Here is the document, but how? https://docs.splunk.com/Documentation/Splunk/8.2.6/Search/Changetheformatofsubsearchresults       Using the query field name Use the query field name when you want the values in the fields returned from the subsearch, but not the field names. The query field name is similarly to using the format command. Instead of passing the field and value pairs to the main search, such as: (field1=val1_1 AND field2=val1_2) OR (field1=val2_1 AND field2=val2_2) Using the query field name passes only the values: (val1_1 AND val1_2) OR (val2_1 AND val2_2)       When rename one fields as query, got `remoteSearch premakeresults 1 ( ( field2="val1_2" AND val1_1 ) )` in inspect job log's remoteSearch. What I want is `remoteSearch premakeresults 1 ( ( "val1_2" AND val1_1 ) )`     | makeresults 1 [ | makeresults 1 | eval field1="val1_1" | eval field2="val1_2" | fields field1 field2 | rename field1 AS query ```| rename field2 AS query``` ]     Below post only rename one field as query. https://community.splunk.com/t5/Splunk-Search/How-to-use-subsearch-without-a-field-name-but-just-with-field/m-p/449282   @woodcock sorry to bother you, seeing a lot of high quality answers from you, seeking your help here. ... View more