Splunk Search

Search time knowledge and lispy

charlesmeo
Explorer

I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned in the materials but not really explained anywhere that I've found so far.

When creating lispy, splunk will use lookups and field extractions from search time, presumably because they are in the knowledge bundle.

However it will not use field aliases, according to the course materials.

So three questions arise from this:
1. Why not aliases? Especially since these underpin the CIM to a great extent.
2. What other search time KOs are/are not evaluated when it's time to create lispy expressions.
3. Where is this documented?

Tags (2)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!