Regex works but transforms.conf extracts only part of the last field

[sigma]

I'm working on a transforms.conf to extract fields from a custom log format. Here's my regex:

REGEX = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d{1,3}(?:\.\d{1,3}){3}\s+\d+\s+\S+\s+(\S+)(?:\s+(iLO\d+))?\s+-\s+-\s+-\s+(.*)
FORMAT = srv::$1 ver::$2 msg::$3
DEST_KEY = _meta

This regex is supposed to extract the following from a log like:

Jul 27 14:10:05 x.y.z.k 1 2025-07-27T14:09:05Z QQQ123-G12-W4-AB iLO6 - - - iLO time update failed. Unable to contact NTP server.

Expected extracted fields:

srv = QQQ123-G12-W4-AB
ver = iLO6
msg = iLO time update failed. Unable to contact NTP server.

The regex works correctly when tested independently, and all three groups are matched. However, in Splunk, only the first two fields (srv and ver) are extracted correctly. The msg field only includes the first word: iLO.

It seems Splunk is stopping at the first space for the msg field, despite the regex using (.*) at the end. Any idea what could be causing this behavior? Is there a setting or context where Splunk treats fields as single-token values by default?
Any advice would be appreciated!

[PickleRick]

Regex101.com doesn't match anything using provided example.

https://regex101.com/r/oJHVx1/1

Are you sure you pasted it correctly?

EDIT: Ok, my bad. It's meant for IP in place of x.y.z.k. With numbers in place it matches.

[PickleRick]

Ok. I think I know. You're writing to_meta (not using $0, BTW) and rendering the matches to a value using key::value space-delimited pairs. You see where I'm going?

 Don't write to _meta directly. Use named capture groups in you regex, don't set FORMAT, set WRITE_META to true.

[vjdev]

Hello,

Did you make the entry for the srv and ver fields in fields.conf?

Thank You!