@@ -674,6 +674,18 @@ max:integer
67467413
675675;
676676
677+ evalAfterStatsUsingSameName3
678+ required_capability: remove_empty_attribute_in_merging_output
679+ from employees
680+ | stats foo = min(emp_no), bar = count_distinct(emp_no)
681+ | rename bar AS bug_here, foo AS baz, baz AS bug_here
682+ | eval bug_here = "something"
683+ ;
684+
685+ bug_here:keyword
686+ something
687+ ;
688+
677689evalAfterAvgGroupingUsingSameName
678690required_capability: retain_aggregate_when_grouping
679691from employees
@@ -752,3 +764,26 @@ g:integer | max:integer
75276412 | 2
75376512 | 2
754766;
767+
768+ evalAfterGroupingUsingSameName5
769+ required_capability: retain_aggregate_when_grouping
770+ required_capability: enrich_load
771+ from firewall_logs,threat_list,airports
772+ | keep `message`, `name`, source.IP, `type`, message
773+ | enrich languages_policy on message
774+ | drop type
775+ | dissect name "%{message}"
776+ | rename language_name as message
777+ | lookup join message_types_lookup on message
778+ | rename `source.IP` AS EkooZqOYHpD, `EkooZqOYHpD` AS `XzWnUOjttGQD`
779+ | drop `XzWnUOjttGQD` | stats type = count_distinct(name), `name` = count(*), JhbpKFAaRq = count(*)
780+ | limit 5791
781+ | keep name
782+ | eval `name` = true, nhIWDevxEtU = null, name = true, `name` = 1, sPMxyWXGSHm = "a", TewXimOwcBYr = true
783+ | stats `nhIWDevxEtU` = min(name) by name
784+ | eval dsjbDWegyVkg = false, name = null, name = 1, nhIWDevxEtU = null, iPIbTFddDK = 1, rUvqtgSl = 1
785+ ;
786+
787+ dsjbDWegyVkg:boolean | name:integer | nhIWDevxEtU:null | iPIbTFddDK:integer | rUvqtgSl:integer
788+ false | 1 | null | 1 | 1
789+ ;
0 commit comments