All Apps and Add-ons

AppInspect v2.2.0 wrongly reports that there is no named capturing group in Extract in props.conf

imrago
Contributor

Hi,

while checking our app with AppInspect v2.2.0 an extract in props.conf was flagged with this error :

xxxxx

check_props_conf_extract_option_has_named_capturing_group
[EXTRACT-nfo_hostname] setting in props.conf specified a regex without any named capturing group. This is an incorrect usage. Please include at least one named capturing group. File: default/props.conf Line Number: 19

xxxxx

Line 19 is :

EXTRACT-nfo_hostname = ((\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2})|(1\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.{1}\d{2}:\d{2}))\s+(?P<nfo_hostname>[^ ]+)\s+(nfc_id|NFO)

It has a named capturing group : (?P<nfo_hostname>[^ ]+)

What could be wrong? The error is not present when checking the built spl file with the CLI version of AppInspect v2.2.0

In my opinion it might be a bug in AppInspect. Attempted to  email appinspect@splunk.com, but it is bouncing back. Is there some other channel to reach the AppInspect team?

0 Karma

imrago
Contributor

I had found out that it is a bug which will be fixed in the future.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...