Hi,
I'm doing some custom regex extractions for various fields and often they'll be under a bigger field for example requesterDN=\"ou=*,uid=*...
Is there a way to have a period character (.) in the name of a regex capture group? And if so, how?
Hi @ebs
Unfortunately Splunk PCRE based rex doesn't allow (.) in field_names. You can test here - https://regex101.com/r/moO5Vq/1
--
An upvote would be appreciated if this reply helps!
Hi @ebs
Unfortunately Splunk PCRE based rex doesn't allow (.) in field_names. You can test here - https://regex101.com/r/moO5Vq/1
--
An upvote would be appreciated if this reply helps!