If the sourcetype is WinEventLog and you have Splunk_TA_windows installed, then there is a conflicting field alias named parent_process_for_windows, so the naming of your alias definition either puts you before or after it during the runtime after merge. If the TA used ASNEW this may not have been an issue, but it uses AS so overwrites the field. This would be why changing the namespace impacts the field alias working. FIELDALIAS-parent_process_for_windows = Creator_Process_Name AS parent_process ... View more

Ok I have a better solution. If you want to use Splunk Create as the Splunk user, and avoid using the Splunk provided NodeJS v8 runtime, remove the Splunk bin from your terminal path first. export PATH=$(echo $PATH | sed -s 's+/opt/splunk/bin:++') node -v  This worked for me to develop as my Splunk user. ... View more

Answered this question myself. The "extracted_host" is actually still "host" in the _meta key, so the solution is to force Splunk to read the _meta key for its value. INGEST_EVAL = host:=$field:host$, $field:host$:=null() ... View more