You can modify the definitions of extracted fields.
VMware Aria Operations for Logs creates copies of the fields that you use when you create charts, queries, or alerts. If you modify a field definition, all charts, queries, and alerts that use the modified field are updated to reflect the new definition.
Administrators and users with edit access for the permission can modify their own content and their shared content. Other users can modify only their own content.
Content pack fields are read-only.
Prerequisites
Verify that you are logged in to the VMware Aria Operations for Logs web user interface as a user associated with the User role, or a role that has the relevant permissions. For more information, see Create and Modify Roles in Administering VMware Aria Operations for Logs. The URL format of the web user interface is https://operations_for_logs-host, where operations_for_logs-host is the IP address or host name of the VMware Aria Operations for Logs virtual appliance.
Procedure
Results
VMware Aria Operations for Logs updates all queries, alerts, and charts that use the field that you modified.
and select an extracted field from the list.
and then