pattern based indexing is not working for some events

[vasanthi77]

I am using pattern base indexing like below that is if i have splunk_send and app host in event i m trying to discard the event. which is working some times and sometimes it is not working.

using below props and transforms files

```

######more props.conf
[source::OCP]
SHOULD_LINEMERGE = false
TRUNCATE = 0
MAX_DAYS_AGO = 10000
TRANSFORMS-viprouting = customer3
######more transforms.conf
[customer3]
REGEX = (?s)(splunk_send).+?(xxxxx-app-c0[0-9]?\.abc\.abc\.cde\.fgh\.com)
FORMAT = nullQueue
DEST_KEY = queue
```

do we have any limitation on length of the event or anything else?
Please help me

[mhoogcarspel_sp]

Probably add

LOOKAHEAD = <something bigger than 4096>

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

LOOKAHEAD = <integer>
* NOTE: This option is valid for all index time transforms, such as
  index-time field creation, or DEST_KEY modifications.
* Optional. Specifies how many characters to search into an event.
* Default: 4096
  * You may want to increase this value if you have event line lengths that
    exceed 4096 characters (before linebreaking).

[gcusello]

Hi vasanthi77,
can you share an example of not discarded logs?
Bye.
Giuseppe