Getting Data In

Splunk Universal Forwarder 7.3.0 index-time field extraction bug

stamstam
Explorer

Hi,
after upgrading splunkforwarder from 7.0.1 to 7.3.0 we started experiencing a weird bug.
We extract several fields at index time from both source field and another field extracted by CSV index-time extraction, and one of them started to get wrong values.
The cause is that we used a capture-group for repetition and than a named capture group to extract the field.
But instead of getting the value matched by the named capture group, the field got the value of the latest match of the first capture group.
The solution was to turn it into a non-capturing group, but i still think it's a bug, because of a few reasons:
1. Because we use a named capture-group we don't use a DEST_KEY and yet a field was extracted. a field with the same name as the transformation.
2. Until version 7.0.1 non-named capture groups were not used for field extraction, unless used with the FORMAT option.

Thank you 🙂

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.