Hi,
We are using Splunk Stream to pull logs from DNS Servers. All the target Servers have similar naming convention and do show up under preview based on the Regex Rule for the group. But one of them never becomes part of the group. This Server(003) ends up under defaultgroup.
Description for defaultgroup reads "Used when there is no matching group found for a given stream forwarder ID", but in this case 003 clearly matches a group along with others.
Are there any other parameters apart from the name which might be playing a role here?
Thanks,
~ Abhi
Facing a similar issue, did you manage to find a resolution?