Splunk Search

Is it possible using rex to create field names that contain a period (.)?

andrewtrobec
Motivator

Hello!

I'm parsing strings using rex and I'd like to define a set of field names that contain the period (.) character. As an example, I'd like to create three fields: AI1.1.1 AI1.1.2 and AI1.1.3. When using the rex command, however, I have only managed to create the fieldnames without the period character. Here is some run anywhere code:

| makeresults
| eval string = "2,4,2"
| rex field=string "(?<AI111>[\d]*),(?<AI112>\d]*),(?<AI113>[\d]*)"

If I replace the rex command with this one:

| rex field=string "(?<AI1.1.1>[\d]*),(?<AI1.1.2>\d]*),(?<AI1.1.3>[\d]*)"

Then it no longer works. I tried escaping, the period, but I cannot get it working.

Is it possible to do what I'm looking to do?

Thank you and best regards,

Andrew

Tags (2)
0 Karma

koshyk
Super Champion

The problem you are encountering is Splunk makes the "KEY" field to be Clean.

Add CLEAN_KEYS = false to your transform if you need to extract field
  names that include non-alphanumeric characters, or which begin with
  underscores or 0-9 characters.
* Default: true

So try setting CLEAN_KEYS = false in transforms.conf for your sourcetype and See if it works.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...