I have been participating in Splunk Advanced Searching and Reporting course and there is one thing that is mentioned in the materials but not really explained anywhere that I've found so far.
When creating lispy, splunk will use lookups and field extractions from search time, presumably because they are in the knowledge bundle.
However it will not use field aliases, according to the course materials.
So three questions arise from this:
1. Why not aliases? Especially since these underpin the CIM to a great extent.
2. What other search time KOs are/are not evaluated when it's time to create lispy expressions.
3. Where is this documented?
