@shayhibah please see the answer I placed on your other answers ask found here: https://answers.splunk.com/answers/657473/fieldalias-override-another-fieldalias.html?childToView=762283#answer-762283 Hope this helps give some clarity to you for the FIELDALIAS function and its limitations! ... View more

I pretty much agree with what you said except that EVAL- is the original search-time field extraction that does not create an indexed field. I think that you meant INGEST_EVAL- for index-time extractions created indexed fields. Also your example seems to imply that transitive field aliases work but they DO NOT. If you do alias foo to bar and you have a foo , you will get a bar but if you further alias bar to bat , you will NOT get a bat . ... View more

For a more in-depth explanation of the limitations of FIELDALIAS, please see my answer on https://answers.splunk.com/answers/657473/fieldalias-override-another-fieldalias.html?childToView=762283#answer-762283 ... View more