Hi,
I had been using search syntax "rename "_raw" AS errortrace" in my custom search but one of my app team needs _raw data to extract some header info.
How can i still pass _raw filed data still with renamin syntax still in place
Thanks
Once a field is renamed the original name no longer exists and cannot be referenced. All subsequent uses of the field must use the new name.
But you can use field alias.
Tried to use "_raw =errortrace" in fields alias section...it did not pick up this field alias.
