All Apps and Add-ons

AppInspect and RegEx Capture Groups

mikedgibson
New Member

In my add-on, I have a RegEx that contains 3 capture groups. However, one of the capture groups is only used within the RegEx as a numeric reference and is not required in the FORMAT field.

Unfortunately, I can't change this to a non-capturing group because it breaks the RegEx since it's dependent on being able to use the numeric reference.

As a result, my add-on always fails AppInspect and I can't seem to find a workaround for this.

Here's my transforms.conf entry for reference.

[replace-customfields]
REGEX = (\S+)=([^=]*)\s+(?:\1Label)=([^=]+)(?:(?:\s\w+=)|$)
FORMAT=$3::$2
KEEP_EMPTY_VALS=True
 

Any ideas would be greatly appreciated.

Labels (2)
Tags (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!