Splunk Search

Search time knowledge and lispy


I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned in the materials but not really explained anywhere that I've found so far.

When creating lispy, splunk will use lookups and field extractions from search time, presumably because they are in the knowledge bundle.

However it will not use field aliases, according to the course materials.

So three questions arise from this:
1. Why not aliases? Especially since these underpin the CIM to a great extent.
2. What other search time KOs are/are not evaluated when it's time to create lispy expressions.
3. Where is this documented?

Tags (2)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>