Getting Data In

Is it possible to use modular regular expressions defined in transforms.conf, in saved field extractions?


I was trying to extract an ip address field. During a search, using

|rex "[[ipv4]]"

works fine and creates an ip field.  I then wanted to save this field extraction, so I used the field extractor to do so, edited the regular expression to [[ipv4]] and saved it, but it did not work.

I tried taking it down a level, editing the saved regular expression to 


which also works while using the rex command during a search, but did not work saving it in the field extractor. I took it down one final level changing it to


which doesn't use modular regular expressions, but finally does work in both the search and the saved field extraction.

I haven't found anything in the splunk docs that say modular regular expressions can't be used in the field extractor, so I thought it would be best to check here if that was the case, or if there is maybe some other issue I can't think of.

0 Karma

Ultra Champion


It seems that it should work but it seems it doesn't always and it's not clear why.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>