One option is to prepend the original fields before sending to the summary index...
| foreach _* *
[| eval orig_<<MATCHSTR>>=<<FIELD>>]
(You may want to only prepend the fields you actually need, and which get overwritten, e.g. host, source, sourcetype, instead of _* * )
... View more