Is it possible to have a period in a regex capture group name for field extractions? e.g. requesterDN.ou

[ebs]

Hi,

I'm doing some custom regex extractions for various fields and often they'll be under a bigger field for example requesterDN=\"ou=*,uid=*...

Is there a way to have a period character (.) in the name of a regex capture group? And if so, how?

[venkatasri · Accepted solution]

Hi @ebs 

Unfortunately Splunk PCRE based rex doesn't allow (.)  in field_names. You can test here - https://regex101.com/r/moO5Vq/1

--

An upvote would be appreciated if this reply helps!