What happens to fields as they move down the pipeline?

[adrianathome]

I have a search that has 3 joins.

search1 | join common_field1 [search2] | join commonfield2 [search3] | table field1, field2, field3, field4

Search1 and Search2 have some fields that have the same name. Search2 and Search3 have some fields that have the same name.

How does Splunk decide which field to use on the table?

Thanks!

[Ron_Naken · Accepted solution]

The default behavior for "join" is to overwrite the shared fields with the results of each join; however, you can override this with the overwrite option:

... | join common_field1 overwrite=f [search2]

Help on JOIN is provided here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Join