When using field aliases, what happens to the original field?

Field aliases in Splunk provide a way to create alternative names for existing fields without altering the original data. When a field alias is created, it acts as an additional reference to the same underlying data, allowing users to search or reference the data using different terminologies as needed. This functionality ensures that the original field remains intact and unchanged, preserving the integrity of the data.

The original field continues to exist in its primary form, so any existing searches, reports, or dashboards that rely on the original field will continue to function without disruption. This flexibility is particularly useful in scenarios where different teams or users may prefer different naming conventions for the same data points, but you want to maintain a consistent source of truth within the data.

In contrast, the other options imply some degree of alteration or removal of the original field, which does not happen with field aliases.