topic Syntax that works in 6.1.1 (SPLUNK Enterprise) doesn't work in 6.4.2 (HUNK) in Splunk Search https://community.splunk.com/t5/Splunk-Search/Syntax-that-works-in-6-1-1-SPLUNK-Enterprise-doesn-t-work-in-6-4/m-p/226328#M176595 <P>This syntax ..</P> <P>| stats sum(transmitted_MB) AS transmitted_total_MB, sum(received_MB) AS received_total_MB, count earliest(_time) AS et count latest(_time) AS lt BY username, src, url, http_method, http_user_agent, filter_category</P> <P>works fine on our Live environment which is 6.1.1 SPLUNK enterprise.</P> <P>We are upgrading and migrating to a 6.4.2 environment using HUNK to a HADOOP back end. The same syntax (literally cut and pasted over) throws the following error.</P> <P>Error in 'stats' command: 1 duplicate rename field(s). Original renames: [transmitted_total_MB received_total_MB count et count lt]. Duplicate renames: [count].</P> <P>Has anyone seen something similar?</P> Tue, 29 Sep 2020 11:15:02 GMT FrankBurns 2020-09-29T11:15:02Z Syntax that works in 6.1.1 (SPLUNK Enterprise) doesn't work in 6.4.2 (HUNK) https://community.splunk.com/t5/Splunk-Search/Syntax-that-works-in-6-1-1-SPLUNK-Enterprise-doesn-t-work-in-6-4/m-p/226328#M176595 <P>This syntax ..</P> <P>| stats sum(transmitted_MB) AS transmitted_total_MB, sum(received_MB) AS received_total_MB, count earliest(_time) AS et count latest(_time) AS lt BY username, src, url, http_method, http_user_agent, filter_category</P> <P>works fine on our Live environment which is 6.1.1 SPLUNK enterprise.</P> <P>We are upgrading and migrating to a 6.4.2 environment using HUNK to a HADOOP back end. The same syntax (literally cut and pasted over) throws the following error.</P> <P>Error in 'stats' command: 1 duplicate rename field(s). Original renames: [transmitted_total_MB received_total_MB count et count lt]. Duplicate renames: [count].</P> <P>Has anyone seen something similar?</P> Tue, 29 Sep 2020 11:15:02 GMT https://community.splunk.com/t5/Splunk-Search/Syntax-that-works-in-6-1-1-SPLUNK-Enterprise-doesn-t-work-in-6-4/m-p/226328#M176595 FrankBurns 2020-09-29T11:15:02Z Re: Syntax that works in 6.1.1 (SPLUNK Enterprise) doesn't work in 6.4.2 (HUNK) https://community.splunk.com/t5/Splunk-Search/Syntax-that-works-in-6-1-1-SPLUNK-Enterprise-doesn-t-work-in-6-4/m-p/226329#M176596 <P>Can you validate if this works when you use Splunk 6.4.2 instead of Hunk 6.4.2?</P> Thu, 06 Oct 2016 15:57:03 GMT https://community.splunk.com/t5/Splunk-Search/Syntax-that-works-in-6-1-1-SPLUNK-Enterprise-doesn-t-work-in-6-4/m-p/226329#M176596 rdagan_splunk 2016-10-06T15:57:03Z