Hi,
We are using Splunk Stream to pull logs from DNS Servers. All the target Servers have similar naming convention and do show up under preview based on the Regex Rule for the group. But one of them never becomes part of the group. This Server(003) ends up under defaultgroup.
Preview lists all matched assets
003 is not added to the group
Description for defaultgroup reads "Used when there is no matching group found for a given stream forwarder ID", but in this case 003 clearly matches a group along with others.
Are there any other parameters apart from the name which might be playing a role here?
Thanks,
~ Abhi
Had similar issue.
https://regexr.com helped me figure it out
Facing a similar issue, did you manage to find a resolution?