If you have index time extractions configured will search time extractions override them?
No, indexing has to happen before searching. This can explain it in more detail:
Well, not entirely true - you can override the values of index-time extractions for the duration of a search (see below), but once an event is stored in an index, it cannot be altered on disk by search time operations.
* | head 5 | eval host=host . "-monkey" | eval source=source . "-crane" | eval sourcetype=sourcetype . "-blah" | table host source sourcetype
Edit: clarification
/K
No, indexing has to happen before searching. This can explain it in more detail: