Splunk Search

Is it possible using rex to create field names that contain a period (.)?

andrewtrobec
Motivator

Hello!

I'm parsing strings using rex and I'd like to define a set of field names that contain the period (.) character. As an example, I'd like to create three fields: AI1.1.1 AI1.1.2 and AI1.1.3. When using the rex command, however, I have only managed to create the fieldnames without the period character. Here is some run anywhere code:

| makeresults
| eval string = "2,4,2"
| rex field=string "(?<AI111>[\d]*),(?<AI112>\d]*),(?<AI113>[\d]*)"

If I replace the rex command with this one:

| rex field=string "(?<AI1.1.1>[\d]*),(?<AI1.1.2>\d]*),(?<AI1.1.3>[\d]*)"

Then it no longer works. I tried escaping, the period, but I cannot get it working.

Is it possible to do what I'm looking to do?

Thank you and best regards,

Andrew

Tags (2)
0 Karma

koshyk
Super Champion

The problem you are encountering is Splunk makes the "KEY" field to be Clean.

Add CLEAN_KEYS = false to your transform if you need to extract field
  names that include non-alphanumeric characters, or which begin with
  underscores or 0-9 characters.
* Default: true

So try setting CLEAN_KEYS = false in transforms.conf for your sourcetype and See if it works.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...