Why ext.domain is being extracted as an ext_domain field?

[ddrillic]

Our raw data holds name value pairs and one of the names is ext.domain. Splunk UI displays this field under the Interesting fields panel as ext_domain. Why is that?

[somesoni2 · Accepted solution]

In my experience, with exception of json and xml data, Splunk will clean the names of the fields to replace dot, space, hyphen etc with underscore.

[ddrillic]

Many thanks!! can you convert it to an answer please?

[somesoni2]

Here you go.