We had a report for which the input CSV data format was 'value-only', but the format was modified to 'key-value' pair. Data with both the formats still went to the same index. The problem that we are facing is the data which was in "value-only" format is not turning up in the results now.
The search query format I am using is,
| rename rr_xxx as "xxx Records", rr_yy as "y Records", rr_w as "w Records", rr_e as "e Records", rr_t as "t Records", rr_r as "r Records", rr_k as "k Records", rr_b as "b Records"
| eval Timestamp = strftime(_time, "%Y-%m-%d %H:%M:%S %Z")
The problem is your rename because it always does something. If you do rename foo AS bar and some events do not have a field named foo, but do have a field named bar, the value for the field named bar will be replaced by null() because that is what the value of foo is for that event. It actually makes perfect sense. It would be nice if we had a boolean argument to this command to force it to do nothing for the null-value case but for now, you can do this with coalesce():