The search string shown below returns valid results when run in Splunk 4.3.4 but it doesn't in Splunk 5.0.
index=agent MTRn |fields MTRn S| join S [search svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site
The result shows empty values for the "MTRn" column and the "S" and "site" columns show data from the subsearch.
Cheers,
... View more