Splunk Search

Bug in interactive field extractor (IFX)?

kristian_kolb
Ultra Champion

There seems to be a bug in the interactive field extractor regarding the naming of fields. If copy-pasting a regex (crafted through rex perhaps), where the field name contains a hyphen (minus/dash/-) instead of the the default placeholder <FIELDNAME>, there will be an error when you hit 'save' ("Illegal character in field name" or something like that).

However, there is nothing stopping you from saving a field extraction which has the default <FIELDNAME> placeholder in the regex, and where the name entered in the 'save' dialog box contains hyphens. The save goes through, but the field never shows up in searches.

Couldn't the same error checking be applied here, since this is a more likely scenario than the copy/paste variant?

This was tested on Splunk 4.3.1 (win-64), and neither the Changelog nor Known Issues for 4.3.2 mention this.

Best regards,

Kristian

0 Karma

webboy
New Member

Thanks for submitting this issue Kristian. I just wanted to add that I originally found this problem on Ubuntu Server 12.04 LTS 64 bit.

I think it was a sort of happy accident that I discovered this after trying your suggestion to help fix my non-working extraction.

The reality is that this is probably happening to a lot of people. I wouldn't think that using the IFX tool and naming extractions with hyphens is terribly uncommon.

Regards,

-Dan

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...