Splunk Enterprise

Cannot save custom field extraction when using my own regex

Julznova_
New Member

Hey, 

I'm attempting to extract a field by using: 

 

(?<=cs4=)(.*\n?)(?=categoryTechnique)

 

It matches 100% of the results, also checked on a regex editor,  but I cannot hit the save button. It continues to be greyed out.
sssss.JPG

I've attempted to create a custom field in Settings > Fields > Field Extractions > Add New

For this source type, but that throws up errors.

Anyone give me a hand?

Thanks!

 

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @Julznova_ 

Following is the error, What are you trying to extract and any sample?

Error in 'rex' command: The regex '(?<=cs4=)(.*\n?)(?=categoryTechnique)' does not extract anything. It should specify at least one named group. Format: (?<name>...).

 

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...