Hi @althomas,
We had the same problem as you do but with another field.
First thing to do is check in the search.log of your search to check all the parsing that is applied.
For us, it was not explicit at all and I had to check all the TAs one by one but finally manage to see what happened.
If I can suggest, a first step would be to check all the transforms.conf and see if you have the same source_key and dest_key for a unique stanza:
[<custom_stanza>]
SOURCE_KEY = user
REGEX = ^(\S+)\s+.*$
FORMAT = user::$1
This example is not correct because having the same src and dest creates a loop and somehow messes with other stuff.
The dest can be:
The DEST_KEY;
A capturing field in REGEX (?...);
The left field within the FORMAT.
Hope this will help.
Regards,
S.
... View more