When I use replace to update a field, it is updated properly (in the interesting fields sidebar) but my search displays the _raw event with the original value. Ex.:
search | replace "ABC" WITH "XYZ*" IN myfield
I can use table but there are parts of the event that are not extracted which I'd like to see. How can I update _raw with the new value of myfield?
... View more