Hi,
after upgrading splunkforwarder from 7.0.1 to 7.3.0 we started experiencing a weird bug.
We extract several fields at index time from both source field and another field extracted by CSV index-time extraction, and one of them started to get wrong values.
The cause is that we used a capture-group for repetition and than a named capture group to extract the field.
But instead of getting the value matched by the named capture group, the field got the value of the latest match of the first capture group.
The solution was to turn it into a non-capturing group, but i still think it's a bug, because of a few reasons:
1. Because we use a named capture-group we don't use a DEST_KEY and yet a field was extracted. a field with the same name as the transformation.
2. Until version 7.0.1 non-named capture groups were not used for field extraction, unless used with the FORMAT option.
Thank you 🙂
