Splunk Search

Rename as Search vs Rename as Query?

Glasses
Builder

Hi
I need a little clarification as the related posts I have found are confusing.

I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

Does rename as query give you all the results in the next phase of the query?

Thank you

Tags (2)
0 Karma

solarboyz1
Builder

a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query

Something like:

search [ search | rename field as search_field ]

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:

search [ search | rename field as search_field | fields search_field  ]

Does rename as query give you all the results in the next phase of the query?

Correct, a rename should not filter any results

0 Karma

Glasses
Builder

Thank you for the reply.

Sorry, I should clarify... this is what I meant...

search ... [search ... | rename <somefield> as search]

vs.

search ... [search ... | rename <somefield> as query]
0 Karma

solarboyz1
Builder

Right, it really doesn't matter what the new field name's are...rename does not filter events.

0 Karma

Glasses
Builder

we might not be thinking about the same thing...

I was referring to the topic in this post...

https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...