For the agt_traffic sourcetype, the issue is that the regex was missing an end of string ($)
Here is the regex without the modular regex. Note User and Rule where not set correctly.
(?i)
(?:\s*'[^']'|\s"[^"]"|\s[^,]),
\s(?[^,']'[^']'|[^,"]"[^"]"|[^,]),
\s(?[^,']'[^']'|[^,"]"[^"]"|[^,]),
\s(?:SHA-256:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:MD-5:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Local:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Local:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Local:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Remote:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Remote:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Remote:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Remote:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?[^,']'[^']'|[^,"]"[^"]"|[^,]),
\s(?[^,']'[^']'|[^,"]"[^"]"|[^,]),
\s(?:Begin:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:End:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Occurrences:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Application:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Rule:\s(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Location:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:User:\s(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Domain:\s(?[^,']'[^']'|[^,"]"[^"]"|[^,])),
\s(?:Action:\s*(?[^,']'[^']'|[^,"]"[^"]"|[^,]*))$
... View more