https://community.splunk.com/t5/Dashboards-Visualizations/Field-extractions-dashboard/m-p/34016#M1526 <P>Hey everyone, I am trying to put the following into a dashboard:</P> <PRE><CODE>index=corrtest sourcetype=as-cdr AS_Service_Provider=wdv-trunking AS_AS_Call_Type!=Interim (AS_Calling_Number=*$TN$ OR AS_Called_Number=*$TN$) |where isnotnull(AS_Access_Call_ID) AND isnotnull(AS_Network_Call_ID) |rex field=AS_Local_Call_ID "(?P&lt;AS_Local_Call_ID_Trimmed&gt;\d+)(?=:)" |dedup AS_Local_Call_ID_Trimmed |eval MSP_vqmcallid=AS_Access_Call_ID |join type=left MSP_vqmcallid [search index=corrtest sourcetype=msp] |table _time AS_AS_Call_Type AS_Access_Call_ID AS_Answer_Indicator AS_Answer_Time AS_Call_Category AS_Called_Number AS_Calling_Number AS_Charge_Indicator AS_Charge_Indicator_Description AS_Codec AS_Codec_Usage AS_Dialed_Digits AS_Direction AS_Group_Number AS_Local_Call_ID AS_Network_Call_ID AS_Network_Call_Type AS_Network_Translated_Number AS_Original_Called_Number AS_Original_Called_Reason AS_Redirecting_Number AS_Redirecting_Reason AS_Release_Time AS_Releasing_Party AS_Remote_Call_ID AS_Route AS_Service_Provider AS_Start_Time AS_Termination_Cause AS_Termination_Cause_Description AS_Transfer_Invocation_Time AS_Transfer_Type AS_Trunk_Group_Info AS_Trunk_Group_Name AS_Type AS_User_Time_Zone MSP_created MSP_serialnumber MSP_avgjbenvdelay MSP_vqmcallid MSP_vqmcallstart MSP_vqmdegradationdiscart MSP_vqmdegradationecholevel MSP_vqmdegradationloss MSP_vqmdegradationnoiselevel MSP_vqmdegradationrecency MSP_vqmdegradationsignallevel MSP_vqmdegradationvocoder MSP_vqmmoslq |sort -_time95 </CODE></PRE> <P>When trying to save, I get an error that there is a problem with the XML. I know the issue exists in this line:</P> <PRE><CODE>|rex field=AS_Local_Call_ID "(?P&lt;AS_Local_Call_ID_Trimmed&gt;\d+)(?=:)" </CODE></PRE> <P>Is there any other way to use a capture group? Or can I do this some other way???</P> Fri, 24 Jun 2011 13:33:18 GMT msarro 2011-06-24T13:33:18Z https://community.splunk.com/t5/Dashboards-Visualizations/Field-extractions-dashboard/m-p/34016#M1526 <P>Hey everyone, I am trying to put the following into a dashboard:</P> <PRE><CODE>index=corrtest sourcetype=as-cdr AS_Service_Provider=wdv-trunking AS_AS_Call_Type!=Interim (AS_Calling_Number=*$TN$ OR AS_Called_Number=*$TN$) |where isnotnull(AS_Access_Call_ID) AND isnotnull(AS_Network_Call_ID) |rex field=AS_Local_Call_ID "(?P&lt;AS_Local_Call_ID_Trimmed&gt;\d+)(?=:)" |dedup AS_Local_Call_ID_Trimmed |eval MSP_vqmcallid=AS_Access_Call_ID |join type=left MSP_vqmcallid [search index=corrtest sourcetype=msp] |table _time AS_AS_Call_Type AS_Access_Call_ID AS_Answer_Indicator AS_Answer_Time AS_Call_Category AS_Called_Number AS_Calling_Number AS_Charge_Indicator AS_Charge_Indicator_Description AS_Codec AS_Codec_Usage AS_Dialed_Digits AS_Direction AS_Group_Number AS_Local_Call_ID AS_Network_Call_ID AS_Network_Call_Type AS_Network_Translated_Number AS_Original_Called_Number AS_Original_Called_Reason AS_Redirecting_Number AS_Redirecting_Reason AS_Release_Time AS_Releasing_Party AS_Remote_Call_ID AS_Route AS_Service_Provider AS_Start_Time AS_Termination_Cause AS_Termination_Cause_Description AS_Transfer_Invocation_Time AS_Transfer_Type AS_Trunk_Group_Info AS_Trunk_Group_Name AS_Type AS_User_Time_Zone MSP_created MSP_serialnumber MSP_avgjbenvdelay MSP_vqmcallid MSP_vqmcallstart MSP_vqmdegradationdiscart MSP_vqmdegradationecholevel MSP_vqmdegradationloss MSP_vqmdegradationnoiselevel MSP_vqmdegradationrecency MSP_vqmdegradationsignallevel MSP_vqmdegradationvocoder MSP_vqmmoslq |sort -_time95 </CODE></PRE> <P>When trying to save, I get an error that there is a problem with the XML. I know the issue exists in this line:</P> <PRE><CODE>|rex field=AS_Local_Call_ID "(?P&lt;AS_Local_Call_ID_Trimmed&gt;\d+)(?=:)" </CODE></PRE> <P>Is there any other way to use a capture group? Or can I do this some other way???</P> Fri, 24 Jun 2011 13:33:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Field-extractions-dashboard/m-p/34016#M1526 msarro 2011-06-24T13:33:18Z https://community.splunk.com/t5/Dashboards-Visualizations/Field-extractions-dashboard/m-p/34017#M1527 <P>Resolved by removing angle brackets and using escape codes &lt; and &gt;</P> Fri, 24 Jun 2011 14:03:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Field-extractions-dashboard/m-p/34017#M1527 msarro 2011-06-24T14:03:34Z