I would like to reuse the same field extraction name for multiple sourcetypes.

[vikram_m]

I would like to reuse the same field extraction name for multiple sourcetypes.

this will help us create one alertfor all the kind of sourceytpes and avoid existing descripancies.

Thanks.
Vikram.

[micahkemp]

There is nothing stopping you from creating extractions in different sourcetypes (or the same sourcetype, for that matter) that use the same field name.

The only limitation in this regard I can think of is you can't define more than one named capture group in a regex with the same name (but it doesn't sound like that's what you're trying).

[mayurr98]

perhaps why do not you try pointing multiple sourcetypes to one props.conf
have a look at this link
https://answers.splunk.com/answers/225433/is-it-possible-to-have-multiple-sourcetypes-point.html

[niketn]

@vikram_m, I think your are looking for Field Aliasing to normalize data from different sourcetypes. You should also read about Common Information Model (CIM)