All Apps and Add-ons

Splunk stream not adding all forwarders that match the regex for Group

att35
Builder

Hi,

We are using Splunk Stream to pull logs from DNS Servers. All the target Servers have similar naming convention and do show up under preview based on the Regex Rule for the group. But one of them never becomes part of the group. This Server(003) ends up under defaultgroup.

Preview lists all matched assetsPreview lists all matched assets

 

003 is not added to the group003 is not added to the group

Description for defaultgroup reads "Used when there is no matching group found for a given stream forwarder ID", but in this case 003 clearly matches a group along with others.

Are there any other parameters apart from the name which might be playing a role here?

Thanks,

~ Abhi

Labels (2)
Tags (1)
0 Karma

jessieb_83
Path Finder

Had similar issue. 
https://regexr.com helped me figure it out

0 Karma

joxers25
Explorer

Facing a similar issue, did you manage to find a resolution?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...