It is absolute insanity that we continue to have this issue - Regex isn't that hard, but Splunk makes it harder by creating new rules and exceptions to those rules. Unfortunately this is why Splunk is in the position they are in - not user-friendly, and lack of proper GUI features that allow testing before integration.
... View more