Difference between renaming a field within STATS vs using RENAME command

[lstewart_splunk]

What is the difference (performance? limitations in later pipes?) between these two searches where one renames a field before a subsequent pipe and another uses the rename command.

sourcetype=access_combined OR sourcetype="vendor_sales" |stats sum(price) as totalSales by product_name

sourcetype=access_combined OR sourcetype="vendor_sales" |stats sum(price) by product_name | rename sum(price) as totalSales

[alacercogitatus · Accepted solution]

So in the searches you have provided, there is no real difference. There is a small gain in readability of the search by using the first search. You don't have to wonder where each of the fields is coming from in the rename, they are provided in the stats command.

There is a slight difference when using the rename command on a "non-generated" field. In your example, sum(price) is a generated field as in, it didn't exist prior to the stats command, so renaming has only the gain of a less messy looking field name. on a "non-generated" field, ie an extracted field, if you rename it, then it looses all connection to it's previous fieldname. This can have unintended consequences for if you have a macro after the rename, but can't see the definition of the macro, you may not have the desired results.

<your_search> | rename sourcetype AS st | stats count AS stcount by sourcetype

This will not work, as you have completely renamed the field, and now can't be referenced by sourcetype.

If you need to have two fields with the same value, use eval.

<your_search> | eval st = sourcetype | stats count AS stcount by sourcetype

This will make sure you don't kill any searches further down the pipe.