Getting Data In

Is it possible to have a period in a regex capture group name for field extractions? e.g. requesterDN.ou

ebs
Communicator

Hi,

I'm doing some custom regex extractions for various fields and often they'll be under a bigger field for example requesterDN=\"ou=*,uid=*...

Is there a way to have a period character (.) in the name of a regex capture group? And if so, how?

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...