Getting Data In

Is it possible to have a period in a regex capture group name for field extractions? e.g. requesterDN.ou

ebs
Communicator

Hi,

I'm doing some custom regex extractions for various fields and often they'll be under a bigger field for example requesterDN=\"ou=*,uid=*...

Is there a way to have a period character (.) in the name of a regex capture group? And if so, how?

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!