Getting Data In

Splunk Universal Forwarder 7.3.0 index-time field extraction bug

stamstam
Explorer

Hi,
after upgrading splunkforwarder from 7.0.1 to 7.3.0 we started experiencing a weird bug.
We extract several fields at index time from both source field and another field extracted by CSV index-time extraction, and one of them started to get wrong values.
The cause is that we used a capture-group for repetition and than a named capture group to extract the field.
But instead of getting the value matched by the named capture group, the field got the value of the latest match of the first capture group.
The solution was to turn it into a non-capturing group, but i still think it's a bug, because of a few reasons:
1. Because we use a named capture-group we don't use a DEST_KEY and yet a field was extracted. a field with the same name as the transformation.
2. Until version 7.0.1 non-named capture groups were not used for field extraction, unless used with the FORMAT option.

Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...