Is it possible using rex to create field names that contain a period (.)?

[andrewtrobec]

Hello!

I'm parsing strings using rex and I'd like to define a set of field names that contain the period (.) character. As an example, I'd like to create three fields: AI1.1.1 AI1.1.2 and AI1.1.3. When using the rex command, however, I have only managed to create the fieldnames without the period character. Here is some run anywhere code:

| makeresults
| eval string = "2,4,2"
| rex field=string "(?<AI111>[\d]*),(?<AI112>\d]*),(?<AI113>[\d]*)"

If I replace the rex command with this one:

| rex field=string "(?<AI1.1.1>[\d]*),(?<AI1.1.2>\d]*),(?<AI1.1.3>[\d]*)"

Then it no longer works. I tried escaping, the period, but I cannot get it working.

Is it possible to do what I'm looking to do?

Thank you and best regards,

Andrew

[koshyk]

The problem you are encountering is Splunk makes the "KEY" field to be Clean.

Add CLEAN_KEYS = false to your transform if you need to extract field
  names that include non-alphanumeric characters, or which begin with
  underscores or 0-9 characters.
* Default: true

So try setting CLEAN_KEYS = false in transforms.conf for your sourcetype and See if it works.