There seems to be a bug in the interactive field extractor regarding the naming of fields. If copy-pasting a regex (crafted through
rex perhaps), where the field name contains a hyphen (minus/dash/-) instead of the the default placeholder
<FIELDNAME>, there will be an error when you hit 'save' ("Illegal character in field name" or something like that).
However, there is nothing stopping you from saving a field extraction which has the default
<FIELDNAME> placeholder in the regex, and where the name entered in the 'save' dialog box contains hyphens. The save goes through, but the field never shows up in searches.
Couldn't the same error checking be applied here, since this is a more likely scenario than the copy/paste variant?
This was tested on Splunk 4.3.1 (win-64), and neither the Changelog nor Known Issues for 4.3.2 mention this.