Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Rename as Search vs Rename as Query?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rename as Search vs Rename as Query?
Hi
I need a little clarification as the related posts I have found are confusing.
I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...
Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?
Does rename as query give you all the results in the next phase of the query?
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query
Something like:
search [ search | rename field as search_field ]
Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?
The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:
search [ search | rename field as search_field | fields search_field ]
Does rename as query give you all the results in the next phase of the query?
Correct, a rename should not filter any results
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for the reply.
Sorry, I should clarify... this is what I meant...
search ... [search ... | rename <somefield> as search]
vs.
search ... [search ... | rename <somefield> as query]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right, it really doesn't matter what the new field name's are...rename does not filter events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we might not be thinking about the same thing...
I was referring to the topic in this post...
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
