<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Posible Bug in Interactive Field Extraction in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22822#M177432</link>
    <description>&lt;P&gt;Still an issue in 4.3&lt;/P&gt;</description>
    <pubDate>Wed, 11 Apr 2012 18:47:20 GMT</pubDate>
    <dc:creator>scrotty</dc:creator>
    <dc:date>2012-04-11T18:47:20Z</dc:date>
    <item>
      <title>Posible Bug in Interactive Field Extraction</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22821#M177431</link>
      <description>&lt;P&gt;In 4.2.1 build 98164 I'm using the Interactive Field Extractor and the Generated pattern automatically generates an expression similar to &lt;CODE&gt;(?:[^:\n]*:){6}//(?P&amp;lt;FIELDNAME2&amp;gt;[^\.]+)&lt;/CODE&gt;. &lt;/P&gt;

&lt;P&gt;When attempting to save the expression a validation error pops: "Each field must have a name. 1 field(s) do not have names."&lt;/P&gt;

&lt;P&gt;Manually Editing the expression and removing the number in the parameter &lt;CODE&gt;&amp;lt;FIELDNAME&amp;gt;&lt;/CODE&gt; i.e. &lt;CODE&gt;(?:[^:\n]*:){6}//(?P&amp;lt;FIELDNAME&amp;gt;[^\.]+)&lt;/CODE&gt; will allow you to save the expression.&lt;/P&gt;

&lt;P&gt;Regenerating the regex pattern changes the &lt;CODE&gt;&amp;lt;FIELDNAME&amp;gt;&lt;/CODE&gt; parameter back to &lt;CODE&gt;&amp;lt;FIELDNAME2&amp;gt;&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Mon, 06 Jun 2011 14:04:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22821#M177431</guid>
      <dc:creator>rhoska</dc:creator>
      <dc:date>2011-06-06T14:04:24Z</dc:date>
    </item>
    <item>
      <title>Re: Posible Bug in Interactive Field Extraction</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22822#M177432</link>
      <description>&lt;P&gt;Still an issue in 4.3&lt;/P&gt;</description>
      <pubDate>Wed, 11 Apr 2012 18:47:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22822#M177432</guid>
      <dc:creator>scrotty</dc:creator>
      <dc:date>2012-04-11T18:47:20Z</dc:date>
    </item>
    <item>
      <title>Re: Posible Bug in Interactive Field Extraction</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22823#M177433</link>
      <description>&lt;P&gt;make sure that &lt;BR /&gt;
fieldname "FIELDNAME" is not being used/generated for other users.&lt;/P&gt;</description>
      <pubDate>Wed, 17 Sep 2014 10:08:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Posible-Bug-in-Interactive-Field-Extraction/m-p/22823#M177433</guid>
      <dc:creator>neelamssantosh</dc:creator>
      <dc:date>2014-09-17T10:08:06Z</dc:date>
    </item>
  </channel>
</rss>

