Once a field alias is created, what can you still do with the original field name?

When a field alias is created in Splunk, it serves as an alternate name for an existing field, allowing users to reference data in a more intuitive or convenient way. Importantly, the original field name remains fully functional and accessible. This means that you can still search using the original field name without any restrictions. The creation of a field alias does not alter the original field; it only provides an additional way to access the same underlying data.

This functionality allows users flexibility in their searches, enabling them to use either the original field name or the alias based on their preference or familiarity with the terminology used in their data sets. Hence, the ability to search with the original field name remains intact after the alias is created.

In contrast, the original field itself cannot be deleted simply because of the alias; the alias acts as a pointer rather than an alteration of the underlying data structure. Renaming the alias does not affect the original field’s identity, and the original field will continue to exist as defined.