Rename as Search vs Rename as Query?

[Glasses]

Hi
I need a little clarification as the related posts I have found are confusing.

I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

Does rename as query give you all the results in the next phase of the query?

Thank you

[solarboyz1]

a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query

Something like:

search [ search | rename field as search_field ]

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:

search [ search | rename field as search_field | fields search_field  ]

Does rename as query give you all the results in the next phase of the query?

Correct, a rename should not filter any results

[Glasses]

Thank you for the reply.

Sorry, I should clarify... this is what I meant...

search ... [search ... | rename <somefield> as search]

vs.

search ... [search ... | rename <somefield> as query]

[solarboyz1]

Right, it really doesn't matter what the new field name's are...rename does not filter events.

[Glasses]

we might not be thinking about the same thing...

I was referring to the topic in this post...

https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...