I have something like this in my logs:
bw_relayhost_abc.ch@test.ch=adjsfsdfsf bw_relayhost_cde.ch@test2.ch=adjsfsdfsfbw_relayhost_abc.ch@test.ch=adjsfsdfsf
My regex looks like this: bw_relayhost_([^=]*)=
I've tested the regex with an online tester and I get three groups out of it:
abc.ch@test.ch
cde.ch@test2.ch
abc.ch@test.ch
Splunk gives me just the first one...
What's up?
Here's my transforms.conf stanza:
[smpt_recipient_reject_ec]
REGEX = bw_relayhost_([^=]*)=
REPEAT_MATCH = true
FORMAT = smtp_recipient::$1
SOURCE_KEY = _raw
DEST_KEY = _meta