What happens when a user edits the regular expression (regex) field extraction generated in the Field Extractor (FX)?

Splunk's Field Extractor enforces a maximum cap on the number of named capture groups (fields) that can be extracted when working in the regex editing interface. Once a user manually edits the generated regex, this field count restriction becomes the operative constraint on the extraction.

Users can still preview extractions after editing the regex; the FX interface continues to provide an extraction preview pane that reflects changes to the regex in real time.

Field extractions created through the FX tool are applied at search time by default; index-time extraction requires explicit configuration outside of the FX workflow.

While the editing workflow does change when modifying the regex manually, the primary documented consequence is the field count limitation, not a permanent lock-out from the automatic workflow.