https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480749#M134699 <P>Right, it really doesn't matter what the new field name's are...rename does not filter events.</P> Fri, 13 Sep 2019 14:30:27 GMT solarboyz1 2019-09-13T14:30:27Z https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480746#M134696 <P>Hi <BR /> I need a little clarification as the related posts I have found are confusing.</P> <P>I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...</P> <P>Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?</P> <P>Does rename as query give you all the results in the next phase of the query?</P> <P>Thank you</P> Fri, 13 Sep 2019 13:22:53 GMT https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480746#M134696 Glasses 2019-09-13T13:22:53Z https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480747#M134697 <P><EM>a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query</EM></P> <P>Something like:</P> <PRE><CODE>search [ search | rename field as search_field ] </CODE></PRE> <P><EM>Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?</EM></P> <P>The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:</P> <PRE><CODE>search [ search | rename field as search_field | fields search_field ] </CODE></PRE> <P><EM>Does rename as query give you all the results in the next phase of the query?</EM></P> <P>Correct, a rename should not filter any results</P> Fri, 13 Sep 2019 14:13:02 GMT https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480747#M134697 solarboyz1 2019-09-13T14:13:02Z https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480748#M134698 <P>Thank you for the reply.</P> <P>Sorry, I should clarify... this is what I meant... </P> <PRE><CODE>search ... [search ... | rename &lt;somefield&gt; as search] vs. search ... [search ... | rename &lt;somefield&gt; as query] </CODE></PRE> Fri, 13 Sep 2019 14:24:10 GMT https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480748#M134698 Glasses 2019-09-13T14:24:10Z https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480749#M134699 <P>Right, it really doesn't matter what the new field name's are...rename does not filter events.</P> Fri, 13 Sep 2019 14:30:27 GMT https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480749#M134699 solarboyz1 2019-09-13T14:30:27Z https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480750#M134700 <P>we might not be thinking about the same thing...</P> <P>I was referring to the topic in this post...</P> <P><A href="https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.html">https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.html</A></P> Fri, 13 Sep 2019 15:00:12 GMT https://community.splunk.com/t5/Splunk-Search/Rename-as-Search-vs-Rename-as-Query/m-p/480750#M134700 Glasses 2019-09-13T15:00:12Z