Hi Splunkers,
I will cut the intro and talk straight to the problem:
I have 5 fields that were declared on props.conf, lets say:
[sourcetype_name]
INDEXED_EXTRACTIONS=csv
TIMESTAMP_FIELDS ="datefield"
FIELDALIAS-alias-may="field1" AS fieldA "field2" AS fieldB "field3" AS field3 "datefield" AS date_created "field5" AS fieldE
I can find field1, fieldA, field2, fieldB, datefield, field5 on the indexed fields, but not for date_created, and fieldE.
but when i move the "field3" AS field3 to the very last of the line, I can find datefield, date_created, field5, and fieldE.
I know it is not a best practice to put the same field name in the props.conf, but why splunk stop the field extraction when it hit error? I think splunk should be able to ignore the error on thus field and continue to extract the next fields.
Can I consider this as a bug?
