How to change field names, while still maintaining the same data.

[metersk]

[search earliest=2/1/2015:00:00:00 latest=2/1/2015:23:59:59 ns=interaction (msg=yes direction=sent) OR (msg=match) |    fields uid o_uid] earliest=2/2/2015:00:00:00 latest=2/5/2015:23:59:59 ns=interaction msg=single_message OR msg=eis | chart count by msg direction

In the query above I search for uids who sent engagement to o_uids on 2/1 and then in the second portion of the query I search for all engagment that was sent for that same uid / o_uid pair.

My issue is that when someone who is on the receiving end of engagement, an o_uid, sends something back, the uid / o_uid pair reverses (in terms of the field name) and I want to be able to capture that data.

Since I have all the IDs, I need a a way to say "also search for the reverse, for each pair where the uid becomes the o_uid and vice versa.

Is it possible to switch the field names like this?

[masonmorales · Accepted solution]

Your best bet would be to search one direction, use the "rename" command (if needed), and then use the "append" command to perform the same search in the other direction, with another "rename" command in that.