Splunk Search

How to get regex named capture group based on back reference for field extraction?

Pat
Path Finder

When doing an extracted field can the regex named capture group be based on a back reference.  The idea is I would have an unamed capture group followed by a named capture group using /1 as the name so the name is what was first captured in the unamed group.  I know the following does not work but im hoping some small change might make it work:

(?<\1>.*?)

Labels (1)
Tags (1)
0 Karma

Pat
Path Finder

can't seem to edit but wanted to mention I tried

 (?<$1>.*?)

as well

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...