Why does a search on the "query" field yield different results than on another name like "query_name"?

[landen99]

The following two searches yield very different results:

...|search NOT [...|rename field AS query]
...| rename query AS query_name | search NOT[...|rename field AS query_name]

[landen99]

...|search NOT [...|rename field AS query]

Does not search the field query, but instead the raw data.
Instead of searching:
NOT(query=value1 OR query=value2 ...)
It searches
NOT(_raw=value1 OR _raw=value2 ...)

If you want to actually search the query field then do this:

   ...| rename query AS query_name |search NOT [...|rename field AS query_name] | rename query_name AS query