Splunk Search

Search time knowledge and lispy

charlesmeo
Explorer

I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned in the materials but not really explained anywhere that I've found so far.

When creating lispy, splunk will use lookups and field extractions from search time, presumably because they are in the knowledge bundle.

However it will not use field aliases, according to the course materials.

So three questions arise from this:
1. Why not aliases? Especially since these underpin the CIM to a great extent.
2. What other search time KOs are/are not evaluated when it's time to create lispy expressions.
3. Where is this documented?

Tags (2)
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...