I have a couple of sources that Splunk is nicely automatically pulling the fields I need into the "Interesting Fields". One is active directory and other is a json. The problem is that I need to use these fields in a data model, but they are not named the same. Is there a way to map these fields to a name so I don't have to manually create an extraction for each? If not, is there anywhere I can see what regexes Splunk is using to extract the fields so I can make sure I get them right?