I'd extracted 2 fields in props.conf as below:
EXTRACT-abc_rac_cd_instance = ^/(cs|app)/abc/.*/adump/(?[^o][^_]+) in source
EXTRACT-abc_single_cd_instance = ^/(cs|app)/abc/(?[^/]+)/.*/adump/o in source
Which means I'd extracted two fields in a source with the same field name "cdinstance". In such cases, which extraction will Splunk consider for the field "cdinstance" ?
Splunk always processes the props.conf sequential. Which means if you define the same field in two or more Extractions it will always be the value of the last called EXTRACT in props.conf.
Just give me a feedback if this is what you wanted to know. Im not quite sure about.
View solution in original post