Well I finally got some regex that worked. Not sure why it worked, but all I did was add a $ at the end and it's working correctly now.
In fact, I had LOADS of problems with this input. Trying to troubleshoot this lead me to trying to figure out why the event was actually multiple events in one event, which when I figured that out I then had to figure out why the times between the splunk event and the log event were off. Anyways, after troubleshooting all day I was able to fix all of the issues.
The final regex that worked was
Outcome:\s(?P<snare_outcome>.*?)$
If someone who is much more regex savvy than myself could possibly explain why this worked that would be nice. And I'm far from regex savvy.
... View more