<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Using search regex fails when the fieldname is a number in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Using-search-regex-fails-when-the-fieldname-is-a-number/m-p/72715#M18204</link>
    <description>&lt;P&gt;Field names cannot begin with a number, so "1" is not a valid field name.&lt;/P&gt;</description>
    <pubDate>Tue, 19 Oct 2010 23:18:22 GMT</pubDate>
    <dc:creator>araitz</dc:creator>
    <dc:date>2010-10-19T23:18:22Z</dc:date>
    <item>
      <title>Using search regex fails when the fieldname is a number</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Using-search-regex-fails-when-the-fieldname-is-a-number/m-p/72714#M18203</link>
      <description>&lt;P&gt;So i have this regex:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| regex sy="\S{4,10}"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;which works fine.  I'm telling it to match only on non-whitespace characters 4 to 10 chars in length.  &lt;/P&gt;

&lt;P&gt;But, when i change the fieldname to a number the regex fails every time.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| regex 1="\S{4,10}"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I tried the following with no luck:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| regex "1"="\S{4,10}"

| regex "1=\S{4,10}"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Any help would be greatly appreciated.&lt;/P&gt;</description>
      <pubDate>Tue, 19 Oct 2010 20:21:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Using-search-regex-fails-when-the-fieldname-is-a-number/m-p/72714#M18203</guid>
      <dc:creator>nnachefski</dc:creator>
      <dc:date>2010-10-19T20:21:02Z</dc:date>
    </item>
    <item>
      <title>Re: Using search regex fails when the fieldname is a number</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Using-search-regex-fails-when-the-fieldname-is-a-number/m-p/72715#M18204</link>
      <description>&lt;P&gt;Field names cannot begin with a number, so "1" is not a valid field name.&lt;/P&gt;</description>
      <pubDate>Tue, 19 Oct 2010 23:18:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Using-search-regex-fails-when-the-fieldname-is-a-number/m-p/72715#M18204</guid>
      <dc:creator>araitz</dc:creator>
      <dc:date>2010-10-19T23:18:22Z</dc:date>
    </item>
  </channel>
</rss>

