https://community.splunk.com/t5/Getting-Data-In/Use-the-extracted-field-instead-existing-field/m-p/582064#M102556 <P>Please tell us more.&nbsp; Are you trying to extract the field at search time or index time?&nbsp; How is the already-present field extracted?</P> Fri, 21 Jan 2022 17:30:31 GMT richgalloway 2022-01-21T17:30:31Z https://community.splunk.com/t5/Getting-Data-In/Use-the-extracted-field-instead-existing-field/m-p/582063#M102555 <P>user field is already present in data, but it is giving the wrong info, I want to extract the user field from raw logs.</P><P>Field name should be "user"</P><P>The field name "user" which I extracted is not showing up in Interested fields as the field name user is already auto extracted.<BR /><BR />May I know how to make my extraction work with the field name "user"</P> Fri, 21 Jan 2022 17:27:02 GMT https://community.splunk.com/t5/Getting-Data-In/Use-the-extracted-field-instead-existing-field/m-p/582063#M102555 VijaySrrie 2022-01-21T17:27:02Z https://community.splunk.com/t5/Getting-Data-In/Use-the-extracted-field-instead-existing-field/m-p/582064#M102556 <P>Please tell us more.&nbsp; Are you trying to extract the field at search time or index time?&nbsp; How is the already-present field extracted?</P> Fri, 21 Jan 2022 17:30:31 GMT https://community.splunk.com/t5/Getting-Data-In/Use-the-extracted-field-instead-existing-field/m-p/582064#M102556 richgalloway 2022-01-21T17:30:31Z