Index time field extraction problem with space

[sigma]

Hi all,

I want to extract fields from a custom log format. Here's my transforms.conf:

REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d{1,3}(?:\.\d{1,3}){3}\s+\d+\s+\S+\s+(\S+)(?:\s+(iLO\d+))?\s+-\s+-\s+-\s+(.*)
FORMAT = name::$1 version::$2 message::$3
DEST_KEY = _meta

This regex is supposed to extract the following from a log like:

Jul 27 14:10:05 1.2.3.4 1 2025-07-27T14:09:05Z QQQ123-G12-W4-AB iLO6 - - - iLO time update failed. Unable to contact NTP server.

Expected extracted fields:

name = QQQ123-G12-W4-AB
version = iLO6
message = iLO time update failed. Unable to contact NTP server.

The regex works correctly when tested independently, and all three groups are matched. However, in Splunk, only the first two fields (name and version) are extracted correctly. The message field only includes the first word: iLO.

It seems Splunk is stopping at the first space for the message field, despite the regex using (.*) at the end. Any idea what could be causing this behavior?
Is there a setting or context where Splunk treats fields as single-token values by default?
Any advice would be appreciated!

[PickleRick]

Why would you create indexed fields in the first place? You have a nice space-delimited entries, if you just want performance, use TERM() in your searches.

[livehybrid · Accepted solution]

Hi @sigma 

The first thing you could try is adding a $ to the end of the REGEX so that the match is forced to run to the end of the line. 

Secondly, are there any other extractions that could be overlapping with this? Its just good to rule out the affects of other props.conf on your work!

Also, instead of DEST_KEY=_meta you could try WRITE_META=true like below, although I dont think this would affect your extraction here:

REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d{1,3}(?:\.\d{1,3}){3}\s+\d+\s+\S+\s+(\S+)(?:\s+(iLO\d+))?\s+-\s+-\s+-\s+(.*)$
FORMAT = name::$1 version::$2 message::$3
WRITE_META = true

Have you defined your fields.conf for the indexed fields?

Add an entry to fields.conf for the new indexed field:

# fields.conf
[<your_custom_field_name>]
INDEXED=true

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing