We have some logs coming in the following format.    ERROR | 2023-03-16 01:27:14 EDT | field1=field1_value | field2=field2_value | field3=field3_value | field4=field4_value | field5=field5_value | field6=field6_value | field7={} | message=Message String with spaces. java.stacktrace.Exception: Exception Details. at ... at ... at ... at ...     Splunk's default extraction works well in getting all key=value pairs, except for the field "message" where only first word before the space is extracted  and drops the rest. To get around this, I used the following inline regex.   | rex field=_raw "message=(?<message>.+)"   This works well in search and extracts the entire message string right until the newline. But when I used the same regex in the configuration file, it seems to be ignoring the newline and continues to match everything else all the way until end of the event. Have tried using EXTRACT as well as REPORT(using transforms.conf) but same result. Do props.conf/transforms.conf interpret regex differently? To summarize,  default Splunk extraction,   message = Message   with inline rex   message = Message String with spaces.   with regex in props/transforms,    message = Message String with spaces. java.stacktrace.Exception: Exception Details. at ... at ... at ... at ...     Any suggestions on how to use this regex from configuration?  Thank you, ... View more

Hi, I have some application logs in the following format:   ERROR | 2021-07-20 06:55:54 EDT | Field1 = Value1 | Field2 = Value2 | Long Error String - Another long error string | Field3 = Value3 | ... | ...     Most of the tokens are in Field=Value format and Splunk is able to extract them just fine except the portion where there is no Field listed. Just two different error strings separated by a " - ".  (These strings may contain other special characters as part of the error) Is there a way I can extract both of them separately, e.g. signature_1, signature_2 without disturbing rest of the extractions? I would prefer doing this with props/transforms. I was thinking of using "DELIMS" option but not sure how to target just that particular part of the log. ... View more