Splunk Search

Rename as Search vs Rename as Query?

Communicator

Hi
I need a little clarification as the related posts I have found are confusing.

I inherited a lot of reports from a previous admin, where a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query...

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

Does rename as query give you all the results in the next phase of the query?

Thank you

Tags (2)
0 Karma

Builder

a subsearch contains a field renamed as search to pass the field value to the next phase of the overall query

Something like:

search [ search | rename field as search_field ]

Does renaming as search only give you a single result (the last or latest result) in the next phase of the query? Does it limit results?

The subsearch should pass ALL fields found as arguments, there should be an additional limiting search command:

search [ search | rename field as search_field | fields search_field  ]

Does rename as query give you all the results in the next phase of the query?

Correct, a rename should not filter any results

0 Karma

Communicator

Thank you for the reply.

Sorry, I should clarify... this is what I meant...

search ... [search ... | rename <somefield> as search]

vs.

search ... [search ... | rename <somefield> as query]
0 Karma

Builder

Right, it really doesn't matter what the new field name's are...rename does not filter events.

0 Karma

Communicator

we might not be thinking about the same thing...

I was referring to the topic in this post...

https://answers.splunk.com/answers/7472/subsearch-fields-query-search-how-do-i-know-which-to-use.htm...

0 Karma