splunkd error

a212830 — Mon, 28 Sep 2020 13:46:41 GMT

Hi,

I'm getting the following error in my splunkd.log, and I can't determine where the issue is. Hoping someone can help me...

The error is:

04-22-2013 14:45:41.122 -0400 ERROR DatetimeInitUtils - Invalid regex ^[ -- Regex: missing terminating ] for character class - data_source="F:\IBM\Lotus\Domino\Trace\UserInfoSA_130419_2323_0.txt", data_host="blahblahblah", data_sourcetype="STCommunityTraceLogs_user"

My inputs.conf is:

[monitor://F:\IBM\Lotus\Domino\Trace\User*.txt]
sourcetype = STCommunityTraceLogs_user
index = euc_sametimedata
disabled = false
followTail = 0
crcSalt =

and my props.conf is:

[STCommunityTraceLogs_user]
TIME_FORMAT = %H:%M:%S.%3N | %d.%m.%Y
MAX_TIMESTAMP_LOOKAHEAD = 55
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TIME_PREFIX = ^[

Re: splunkd error

kristian_kolb — Mon, 22 Apr 2013 19:05:26 GMT

Yes, you'll need to escape the square bracket in TIME_PREFIX. Otherwise Splunks regex engine will see the as the start of a character class.

So;

TIME_PREFIX=^\[

Also, if you need the crcSalt, I believe that it should be in uppercase; <SOURCE>

Re: splunkd error

a212830 — Mon, 22 Apr 2013 19:49:14 GMT

Thanks, appeared to work.

topic Re: splunkd error in Security

splunkd error

Re: splunkd error

Re: splunkd error