Hello!
I'm parsing strings using rex
and I'd like to define a set of field names that contain the period (.) character. As an example, I'd like to create three fields: AI1.1.1
AI1.1.2
and AI1.1.3
. When using the rex
command, however, I have only managed to create the fieldnames without the period character. Here is some run anywhere code:
| makeresults
| eval string = "2,4,2"
| rex field=string "(?<AI111>[\d]*),(?<AI112>\d]*),(?<AI113>[\d]*)"
If I replace the rex
command with this one:
| rex field=string "(?<AI1.1.1>[\d]*),(?<AI1.1.2>\d]*),(?<AI1.1.3>[\d]*)"
Then it no longer works. I tried escaping, the period, but I cannot get it working.
Is it possible to do what I'm looking to do?
Thank you and best regards,
Andrew
The problem you are encountering is Splunk makes the "KEY" field to be Clean.
Add CLEAN_KEYS = false to your transform if you need to extract field
names that include non-alphanumeric characters, or which begin with
underscores or 0-9 characters.
* Default: true
So try setting CLEAN_KEYS = false
in transforms.conf for your sourcetype and See if it works.