I've installed the v8.2.0 Splunk App for Unix and Linux on my search head per the instructions in the documentation. However, restarting Splunk throws an error of:
Bad regex value: '(?::){0}*', of param: props.conf / [(?::){0}*]; why: this regex is likely to apply to all data and may break summary indexing, among other Splunk features.
This appears to be coming from the {%appdir%}\default\props.conf file:
## Dropdowns
[(?::){0}*]
LOOKUP-dropdowns = dropdownsLookup host OUTPUT unix_category unix_group
As a result, the Metrics page in the app is non-functional.
Is anyone else having this issue? What did you do resolve it?
