Editing extracted fields' regex

voxeoRamya — Wed, 06 Jul 2011 18:43:56 GMT

Hey,

I would like to know how to change / modify / edit the regex for an extracted field. Your video tutorials were great in helping me learn and understand creating fields. Thanks 🙂

Best,

Ramya

Re: Editing extracted fields' regex

steveirogers — Wed, 06 Jul 2011 19:36:53 GMT

Edit regex for extracted fields:
If you have already saved the extracted field, then in Version 4.1.2, try the following:
Go to the Manager link and click on the following:
Manager --> Fields --> Field extractions
Select your field from the list

You should get an input field with your regex avialable for editing.

topic Editing extracted fields' regex in Splunk Search

Editing extracted fields' regex

Re: Editing extracted fields' regex