This is incorrect; the text above is from an SPL2 page, not an SPL page. The correct info is this: Proper field name syntax Field names must conform to the field name syntax rules. Valid characters for field names are a-z, A-Z, 0-9, . , :, and _. Field names cannot begin with 0-9 or _ . Leading underscores are reserved for Splunk Enterprise internal variables. which can be found here: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutregularexpressionswithfieldextractions
... View more