Splunk Search

Editing extracted fields' regex

voxeoRamya
Engager

Hey,

I would like to know how to change / modify / edit the regex for an extracted field. Your video tutorials were great in helping me learn and understand creating fields. Thanks 🙂

Best,

Ramya

steveirogers
Communicator

Edit regex for extracted fields:
If you have already saved the extracted field, then in Version 4.1.2, try the following:
Go to the Manager link and click on the following:
Manager --> Fields --> Field extractions
Select your field from the list

You should get an input field with your regex avialable for editing.

Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...