topic Re: edit existing field extraction splunk ui in Splunk Search

edit existing field extraction splunk ui

pdevosceazure — Wed, 20 Jan 2021 17:16:33 GMT

After Extracting fields for a source type, and spending a lot of time renaming them. I noticed I missed one.

I can go to setting > fields > Field extractions,

I can find my saved extraction by name. But is there any way to edit it?

richgalloway — Wed, 20 Jan 2021 18:04:56 GMT

Clicking on the name of the extraction should bring up a dialog box that lets you modify it.

pdevosceazure — Mon, 25 Jan 2021 08:39:26 GMT

Thanks, However, edition just let me change the name, not editing fields

scelikok — Mon, 25 Jan 2021 08:48:33 GMT

You need to go Fields » Field transformations page and find "dsa-unix" to edit fields.

pdevosceazure — Mon, 25 Jan 2021 08:54:35 GMT

Brilliant thank, this is it.

Much appreciated

richgalloway — Mon, 25 Jan 2021 13:48:10 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.