Splunk stream not adding all forwarders that match the regex for Group

[att35]

Hi,

We are using Splunk Stream to pull logs from DNS Servers. All the target Servers have similar naming convention and do show up under preview based on the Regex Rule for the group. But one of them never becomes part of the group. This Server(003) ends up under defaultgroup.

Preview lists all matched assets

003 is not added to the group

Description for defaultgroup reads "Used when there is no matching group found for a given stream forwarder ID", but in this case 003 clearly matches a group along with others.

Are there any other parameters apart from the name which might be playing a role here?

Thanks,

~ Abhi

[jessieb_83]

Had similar issue. 
https://regexr.com helped me figure it out

[joxers25]

Facing a similar issue, did you manage to find a resolution?