I have some logs that are very inconsistent and need to get a source number that is displayed one of few different ways: Source Number: 47107 Source id: Meter <47107> Source id: 47107 I can successfully weed out all of the Source prefixes, but I can't find a way to remove the "<" and ">" from the field extraction. Here is what I have tried so far: (?:Source\sid:|Source\sNumber:)(?:\sMeter\s|\s)(?<MeterNumber>((?:<)\d*(?:>)|\d*)) We can see that I tried ignoring the "<" and ">", but they are still showing up in search results. Is there any way I can drop them as part of the field extraction? Thanks in advance! Virgil ... View more

I am only receiving the first two lines of a log entry into Splunk: Date: 2019/03/12 14:00:10 SOFTWARE Module: D:\SOFTWARE_Enterprise\Service6.exe Machine Name: TESTSERVER001T Database Name: ORA-TEST When the full entry should be: Date: 2019/03/12 14:00:10 SOFTWARE Module: D:\SOFTWARE_Enterprise\Service6.exe Machine Name: TESTSERVER001T Database Name: ORA-TEST Product Version: Release X.XX.XX.XX Jul 20 2018 11:57:17 Source id: Device <7616> Software Integration Service Unavailable Other log entries from other indexes are displaying the full log entries until they reach the truncate size, and this one is shorter than those. Any thoughts on where I can look to fix this would be appreciated. Regards, Virgil ... View more