Splunk rex command field collision and precedence

Dynamic Field Extraction Behavior

The rex command in Splunk allows for inline regular expression extractions to create transient fields during search execution. When a named capture group in a rex statement matches a field name that already exists—either as an index-time extraction or a persisted props.conf configuration—the system must resolve the conflict.

There is uncertainty regarding the precedence of these values when the rex command is placed at different stages of the search pipeline relative to other transforming commands.

• Does the rex command overwrite the existing field value for the remainder of the pipeline?
• Is the original field value preserved in a hidden state, or is it permanently replaced in the result set?