First, my vote is always for "xxx_yyy" format, and it matches up with the common information model anyways.
However, I say it's a bad idea. It sounds like you're trying to account for user stupidity, which tends to be unavoidable and not worth the time. I think the field name should be common to multiple sources and apps if it has the same meaning/value. Educate the user on proper searching -- if they need exception_id from a particular source, sourcetype, or eventtype, then that's how they should craft the search. If they want all exception_id values from their entire install they shouldn't have to jump through hoops to get there.
If there's real concern about data sharing, the real way to do that is by putting data into different indexes. In that way, you even gain RBAC if they need it.
There certainly will be cases where a field needs a name that communicates some sort of context or uniqueness, but I don't think it should be a wholesale act of creating special fields names.
... View more