Is there a way to customize delimiter based field extractions via the UI? Looks like you can do it for regular expression but not for delimiter based field extractions.
If you create a delimiter based field extraction Splunk will create two objects. One in the “Field Extractions” menu, this is where all regular extractions are displayed as well.
In order to modify a delimiter based field extraction, you have to go to the “Field transformations” menu (screenshot attached) in order to do modifications.
Credit @Kai-Ping Seidenschnur and @Rene Siekermann
If you create a delimiter based field extraction Splunk will create two objects. One in the “Field Extractions” menu, this is where all regular extractions are displayed as well.
In order to modify a delimiter based field extraction, you have to go to the “Field transformations” menu (screenshot attached) in order to do modifications.
Credit @Kai-Ping Seidenschnur and @Rene Siekermann