topic Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"? in Splunk Search

How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

Amandeepsin — Fri, 03 Apr 2015 07:16:16 GMT

I am facing issue with regexes. Can any body help me resolving the errors below?

Checking conf files for problems...
                        Bad regex value: `(?i) document:(?P<peppol-out-file>[^ ]+)`, of param: props.conf / [peppol-outbound] / EXTRACT-peppol-out-file; why: syntax error in subpattern name (missing terminator)
                        Bad regex value: `(?i) Name:(?P<peppol-in-file>[^ ]+)`, of param: props.conf / [peppol-oxalis] / EXTRACT-peppol-in-file; why: syntax error in subpattern name (missing terminator)
                One or more regexes in your configuration are not valid. For details, please see btool.log or directly above.

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

richgalloway — Fri, 03 Apr 2015 12:26:21 GMT

I think the hyphens in your field names are the problem. Try replacing them with underscores or removing them.

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

Amandeepsin — Fri, 03 Apr 2015 12:31:59 GMT

But it is showing Missing Terminators.. Whats That..?

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

richgalloway — Fri, 03 Apr 2015 12:40:52 GMT

The missing terminator is either the '>' or ')' that is not found because the parser stopped at the '-' that doesn't belong there. It's a bad error message.