Can a field extraction and lookup share the same field name?

[carmackd]

Is it possible for a field generated by an automatic lookup to share the same name as a field generated by an extraction?

For example, I have a signature_id field, which is fed into a lookup table and returns a field called signature. Not every event has a signature_id so I need to use a field extraction on the same log source to pull signature values. This extracted field would also be called signature.

So far I haven't been able to do this. I've extracted the signature values fine, and the lookup table returns the values as it should, but I can not name them both signature. Is there a configuration that would allow me to do this?

[gkanapathy · Accepted solution]

You can, but by default the lookup will not overwrite a target field if it already exists in the event. You can make it do the overwrite by using OUTPUTNEW rather than OUTPUT when defining the lookup.

[carmackd]

Thanks! worked like a charm