splunk 提取字段_Splunk - 用点/句点提取字段(Splunk - extract a field with dot/period)

There are several different things going on here.

First, No, you cannot create a regex with a dot in the field name being extracted. (tested over at regex101.com, and it doesn't work.)

When extracted from a JSON, splunk can create fields that have a dot in them, signifying the hierarchy of the JSON.

On the other hand, when auto extracting from normal data, splunk will normally replace invalid characters with underscores.

To extract a JSON, normally you use the spath command.

To pull out a regex, just give it a valid name and then rename to contain the dot.

| makeresults

| eval message="Shiver me timbers, goes the pirate"

| table message

| rex field=message "(?[^,]+)"

| rename piratesays as "pirate.say"

I've forgotten whether you need single or double quotes for the odd name, so if that doesn't work, try this.

| rename piratesays as 'pirate.say'