https://community.splunk.com/t5/Splunk-Search/Splunk-Field-Extraction/m-p/77782#M19662 <P>Field names in Splunk must contain only alphabetic characters, numbers and underscore. The name may not begin with a number. In some cases, spaces are allowed, but not in automatic field extraction.</P> <P>I expect that this is what is causing your problem. There are potentially ways around this:</P> <P>General field extraction info: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime</A></P> <P>More detailed info - probably the most useful page: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles</A></P> <P>Tons of details here (look halfway down the page for Field Extractions): <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Propsconf</A></P> Mon, 18 Jun 2012 18:50:13 GMT lguinn2 2012-06-18T18:50:13Z https://community.splunk.com/t5/Splunk-Search/Splunk-Field-Extraction/m-p/77781#M19661 <P>Out of the box, Splunk performs field extractions of name/value pairs separated by an "=" sign. We would like to know what special characters disrupt this tagging. For instance, name[subname]=value<BR /> name;subname=value<BR /> name#subname=value</P> <P>will not tag appropriately. This does tag appropriately -</P> <P>name_subname=value</P> <P>How are other special characters handled?</P> Mon, 18 Jun 2012 14:37:29 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Field-Extraction/m-p/77781#M19661 sgarvin55 2012-06-18T14:37:29Z https://community.splunk.com/t5/Splunk-Search/Splunk-Field-Extraction/m-p/77782#M19662 <P>Field names in Splunk must contain only alphabetic characters, numbers and underscore. The name may not begin with a number. In some cases, spaces are allowed, but not in automatic field extraction.</P> <P>I expect that this is what is causing your problem. There are potentially ways around this:</P> <P>General field extraction info: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Addfieldsatsearchtime</A></P> <P>More detailed info - probably the most useful page: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">http://docs.splunk.com/Documentation/Splunk/4.3.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles</A></P> <P>Tons of details here (look halfway down the page for Field Extractions): <A href="http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/Propsconf</A></P> Mon, 18 Jun 2012 18:50:13 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Field-Extraction/m-p/77782#M19662 lguinn2 2012-06-18T18:50:13Z