Splunk Search

Editing extracted fields' regex

voxeoRamya
Engager

Hey,

I would like to know how to change / modify / edit the regex for an extracted field. Your video tutorials were great in helping me learn and understand creating fields. Thanks 🙂

Best,

Ramya

steveirogers
Communicator

Edit regex for extracted fields:
If you have already saved the extracted field, then in Version 4.1.2, try the following:
Go to the Manager link and click on the following:
Manager --> Fields --> Field extractions
Select your field from the list

You should get an input field with your regex avialable for editing.