All Apps and Add-ons

AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.conf

imrago
Contributor

Hi,

while checking our app with AppInspect v2.2.0 an extract in props.conf was flagged with this error :

xxxxx

check_props_conf_extract_option_has_named_capturing_group
[EXTRACT-nfo_hostname] setting in props.conf specified a regex without any named capturing group. This is an incorrect usage. Please include at least one named capturing group. File: default/props.conf Line Number: 19

xxxxx

Line 19 is :

EXTRACT-nfo_hostname = ((\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2})|(1\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.{1}\d{2}:\d{2}))\s+(?P<nfo_hostname>[^ ]+)\s+(nfc_id|NFO)

It has a named capturing group : (?P<nfo_hostname>[^ ]+)

What could be wrong? The error is not present when checking the built spl file with the CLI version of AppInspect v2.2.0

In my opinion it might be a bug in AppInspect. Attempted to  email appinspect@splunk.com, but it is bouncing back. Is there some other channel to reach the AppInspect team?

0 Karma

imrago
Contributor

I had found out that it is a bug which will be fixed in the future.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...