It sounds like you may be misunderstanding field extraction.
When you send data to Splunk via a forwarder, it is tagged with the sourcetype that you defined/created. That's used to identify the fields contained within your data (events) when Splunk indexes the data.
Field extraction occurs when you search the data, not when it is indexed. It is possible to modify extraction for NEW events coming in, but you cannot go back and redefine that sourcetype for existing data. Once it has been indexed it cannot be changed.
---- An upvote would be appreciated and Accept Solution if it helps!