Different field value result - props.conf versus rex - using same regular expression

[Derek]

I have an event that is coming from a Windows forwarder. When you view the event in the log file on the server it looks like this:

---- log entry made at 07/02/2010 09:15:00
Incoming SMTP call from a.b.c.d at 09:15:00.
Message [email protected] received at 09:15:00 from mail1.outsidedomain.com (unverified [a.b.c.d]).
Size: 18842 bytes
Return-path: [email protected]
Recipients: [email protected],
Incoming SMTP (SSL/TLS) call from a.b.c.d completed at 09:15:00.

When you search for the event in splunk web it looks the same.

If I use rex in search to get the Return-path using: (?i)\-path: (?P<from>.*) I get the proper values '[email protected]', but if I put the regex into props.conf for that field I'm getting '[email protected]: [email protected], Incoming SMTP (SSL/TLS) call from a.b.c.d completed at 09:15:00.'

Is it possible for splunk web to be putting a newline in or something like that?

[gkanapathy · Accepted solution]

Change it to:

(?i-s)-path: (?P<from>.*)

or:

(?i)-path: (?P<from>\V*)

\V is "not vertical whitespace character"

[gkanapathy]

basically, the difference is that rex apparently has the (?s) option on by default, and props.conf does not. this determines whether . matches newlines. the first example turns off the option, the second makes it irrelevant.