All Apps and Add-ons

Splunk stream not adding all forwarders that match the regex for Group



We are using Splunk Stream to pull logs from DNS Servers. All the target Servers have similar naming convention and do show up under preview based on the Regex Rule for the group. But one of them never becomes part of the group. This Server(003) ends up under defaultgroup.

Preview lists all matched assetsPreview lists all matched assets


003 is not added to the group003 is not added to the group

Description for defaultgroup reads "Used when there is no matching group found for a given stream forwarder ID", but in this case 003 clearly matches a group along with others.

Are there any other parameters apart from the name which might be playing a role here?


~ Abhi

Labels (2)
Tags (1)
0 Karma