All Apps and Add-ons

AppInspect and RegEx Capture Groups

mikedgibson
New Member

In my add-on, I have a RegEx that contains 3 capture groups. However, one of the capture groups is only used within the RegEx as a numeric reference and is not required in the FORMAT field.

Unfortunately, I can't change this to a non-capturing group because it breaks the RegEx since it's dependent on being able to use the numeric reference.

As a result, my add-on always fails AppInspect and I can't seem to find a workaround for this.

Here's my transforms.conf entry for reference.

[replace-customfields]
REGEX = (\S+)=([^=]*)\s+(?:\1Label)=([^=]+)(?:(?:\s\w+=)|$)
FORMAT=$3::$2
KEEP_EMPTY_VALS=True
 

Any ideas would be greatly appreciated.

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...