topic Re: Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier' in Getting Data In

Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

nareerat_pr — Wed, 20 Apr 2022 15:55:19 GMT

I found many errors from _internal log

ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-regmon.exe" splunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

Any ideas how to resolve this error?

Re: Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

Stefanie — Wed, 20 Apr 2022 18:07:48 GMT

Do you have any REGEX in your inputs.conf ? That's where I would look first.

Re: Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

nareerat_pr — Thu, 21 Apr 2022 10:02:46 GMT

there are no any REGEX

this is my inputs.conf on uf

Re: Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

Stefanie — Thu, 21 Apr 2022 12:54:29 GMT

And that's the only inputs.conf located on your UF? Splunk-regmon is trying to be ran from some configuration. Were you actively monitoring the registry before this error started to pop up?

Take a look at this article: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowsregistrydata

The inputs.conf file contains the specific regular expressions you create to refine and filter the Registry hive paths you want the Splunk platform to monitor.

It could be that the app is looking at the wrong inputs.conf and getting confused.

Try running this command to look through all of your inputs.confs

D:\SplunkUniversalForwarder\bin\splunk.exe btool inputs list > ..\btool.txt

It will create a txt file for you to go through.