Way late to this answer but hopefully it will help future searchers. Splunk seems to use hoisting with the rename command. Hoisting is when a variable or expression is hoisted to the top of the current scope and evaluated before anything else. When I was using the rename command it was at the end of my table after my fieldformat commands and resulted in incorrect output. Once I switched the variable names in my fieldformat commands to the renamed variables, my output was correct. ,Way late to this answer but hopefully it will help future searchers. I used the table command with fieldformat to parse my data. I had my rename command after my fieldformat which then resulted in incorrect results. I believe that rename is hoisted similar to how javascript hoists variables to the beginning of their scope before evaluating them. So when I used rename, it was hoisted to the top of the table scope, my variables were renamed and then had fieldformat run on them resulting in incorrect results. Once you use rename you need to use the renamed variables in your fieldformat functions for the data to process properly. ... View more