https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268489#M51499 <P>As the error indicates, for stanza <CODE>dvc_for_junos_fw</CODE>, the REGEX attribute set in transforms.conf is invalid. So, you need to correct the regular expression. Easiest way to validate if a regex is valid or not is to use <A href="https://regex101.com/">https://regex101.com/</A> or similar tool. Based on my testing, you need to escape the hyphen with backslash. (use <CODE>\s+([.\-\w]+)\s+RT_FLOW</CODE> instead of <CODE>\s+([.-\w]+)\s+RT_FLOW</CODE>)</P> Thu, 02 Feb 2017 19:01:25 GMT somesoni2 2017-02-02T19:01:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268488#M51498 <PRE><CODE>Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: invalid range in character class </CODE></PRE> <P>Has anybody else had the same errors? if so, what was your solution?</P> Thu, 02 Feb 2017 18:35:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268488#M51498 Waltersr24 2017-02-02T18:35:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268489#M51499 <P>As the error indicates, for stanza <CODE>dvc_for_junos_fw</CODE>, the REGEX attribute set in transforms.conf is invalid. So, you need to correct the regular expression. Easiest way to validate if a regex is valid or not is to use <A href="https://regex101.com/">https://regex101.com/</A> or similar tool. Based on my testing, you need to escape the hyphen with backslash. (use <CODE>\s+([.\-\w]+)\s+RT_FLOW</CODE> instead of <CODE>\s+([.-\w]+)\s+RT_FLOW</CODE>)</P> Thu, 02 Feb 2017 19:01:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268489#M51499 somesoni2 2017-02-02T19:01:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268490#M51500 <P>which transforms.conf file would i need to change? i'm pretty new to Splunk and still learning alot of the basics .</P> Thu, 02 Feb 2017 19:29:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-resolve-quot-Bad-regex-value-quot-error-in-transforms/m-p/268490#M51500 Waltersr24 2017-02-02T19:29:19Z