Why does FIELDALIAS work or doesn't depending on the name of the definition?

[bowesmana]

I have a field extracted with transforms called Parent_Process.

I set up a field alias Parent_Process as parent_process

If I name the alias as anything alphabetically up to "parent_process" the alias does not work. If I name the alias anything from "parent_procest" (replace last s with t), or any other name alphabetically later than "parent_process" (tried about 5 variants), then it DOES work.

There is only this SINGLE alias - it has global scope. btool with app context showing list of props, does not seem to show anything different other than the name of the alias...

I thought aliases were done after transforms, so just can't understand why this happens like this.

Any idea what I am missing?

[Brett · Accepted solution]

If the sourcetype is WinEventLog and you have Splunk_TA_windows installed, then there is a conflicting field alias named parent_process_for_windows, so the naming of your alias definition either puts you before or after it during the runtime after merge. If the TA used ASNEW this may not have been an issue, but it uses AS so overwrites the field.

This would be why changing the namespace impacts the field alias working.

FIELDALIAS-parent_process_for_windows = Creator_Process_Name AS parent_process