My goal is to match whatever is after "Commit Description:" up until but not including the " after TASK0123456. I don't want to match the specific TASK[0-9]*, just whatever someone enters in a Palo Alto commit description.
I am using the following regex string and it shows to match fine in the regex query field extraction page.
(?<=Description:\s)(?P<pansys_commitdes>\w+)
However, my issue is when doing a search in Splunk, the field shows up and seems to work correctly...until I use it in a search. My goal is to effectively look for pansys_commitdes!="*CHG*" OR pansys_commitdes!="*TASK*" with the intent of creating a report of changes that are not following change control processes. With these searches I get no matches. I also tried pansys_commitdes=* and pansys_commitdes="*" and also get no matches...but if I do pansys_commitdes=TASK0123456 it matches fine.
This is an example of a log I'm trying to match on:
Feb 22 09:08:52 paloalto.contoso.com 1,2021/02/22 09:08:52,01234567890,SYSTEM,general,0,2021/02/22 09:08:52,,general,,0,0,general,informational,"CommitAll job started processing. Dequeue time=2021/02/22 09:08:52. JobId=3938587.User: abc . Commit Description: TASK0123456",22356363,0x0,0,0,0,0,,pan-01
