Getting Data In

Is it possible to have a period in a regex capture group name for field extractions? e.g. requesterDN.ou

ebs
Communicator

Hi,

I'm doing some custom regex extractions for various fields and often they'll be under a bigger field for example requesterDN=\"ou=*,uid=*...

Is there a way to have a period character (.) in the name of a regex capture group? And if so, how?

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...