edit existing field extraction splunk ui

[pdevosceazure]

After Extracting fields for a source type, and spending a lot of time renaming them. I noticed I missed one.

I can go to setting > fields > Field extractions,

I can find my saved extraction by name. But is there any way to edit it?

[scelikok · Accepted solution]

Hi @pdevosceazure,

You need to go Fields » Field transformations page and find "dsa-unix" to edit fields.

[pdevosceazure]

Brilliant thank, this is it.

Much appreciated

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[richgalloway]

Clicking on the name of the extraction should bring up a dialog box that lets you modify it.

[pdevosceazure]

Thanks, However, edition just let me change the name, not editing fields