Splunk for Fortinet FortiOS 5: Is anyone else getting transforms errors "Regex: two named subpatterns have the same name"?

[billford]

Anyone else getting Regex: two named subpatterns have the same name. Bad regex for the field extractions in this app? I'm having a day so I want to be sure it isn't just me.

Regex: two named subpatterns have the same name.  Bad regex: (devname\=(?\S+)|clusterid\=(?\S+)) devid\=(?\S+) logid\=(?\S+) (type\=app-ctrl|subtype\=(?\S+)) (subtype\=(?\S+)|type\=app-ctrl) (timestamp=(?\S+) |)pri\=(?\S+) (user=(?\S+) group=(?\S+) profile=(?\S+) srcip\=(?\S+) srcport\=(?\S+) srcintf\=(?\S+) dstip\=(?\S+) dstport\=(?\S+) dstintf\=(?\S+) src_name=(?\S+) dst_name\=(?\S+) proto\=(?\S+) service\=(?\S+) policyid\=(?\S+) serial\=(?\S+) applist\=(?\S+) apptype\=(?\S+) app=(?\S+) action=(?\S+) count=(?\S+) filesize=(?\S+) msg\="(?[^\"]+)" vd=(?\S+) attackid=(?\S+) profiletype=(?\S+) profilegroup=(?\S+) identidx\=(?\S+) hostname\=(?\S+) url\=(?\S+)|vd\="(?[^\"]+)" attackid\=(?\S+) user\="(?[^\"]+)" group="(?[^\"]+)" srcip\=(?\S+) srcport\=(?\S+) srcintf\="(?[^\"]+)" dstip\=(?\S+) dstport\=(?\S+) dstintf\="(?[^\"]+)" src_name\="(?[^\"]+)" dst_name\="(?[^\"]+)" profilegroup\="(?[^\"]+)" profiletype\="(?[^\"]+)" profile\="(?[^\"]+)" proto\=(?\S+) service\=(?\S+) policyid\=(?\S+) identidx\=(?\S+) serial\=(?\S+) applist\="(?[^\"]+)" apptype\="(?[^\"]+)" app\="(?[^\"]+)" action\=(?\S+) count\=(?\S+) hostname\=(?\S+) url\=(?\S+) msg\="(?[^\"]+)")
            Config problem: invalid regex: transforms.conf / [extract_app-ctrlv5] / REGEX

Over and over again for each extract. I'm running 6.1.4, thanks in advance.

Bill

[open3s]

Hi there,
There is a new version on the app. Please check if this solves your problems.
Thanks,
Open3S.

[mad4wknds]

I have installed the new version

I am having the same issue in 5 of my default transforms

Bad regex value: [Regex] , of param: transforms.conf / [stanza below] / REGEX; why: two named subpatterns have the same name

[extract_event_his-performancev5]
[extract_ipsv5]
[extract_trafficv5]
[extract_virusv5]
[extract_webfilterv5]

[fortinet]

i have started using it since last few days. no error so far....

[billford]

I can't imagine Windows making any difference, I might try that though

[fortinet]

I have installed 6.2 on windows 8

[billford]

I've installed it on an empty 6.1.4, 6.1.5 and 6.2 splunk (empty as in fresh install) and I get the same errors. I actually reworked it to not get the errors and to be CIM-compliant so my issue is resolved but I'm curious what version you're running.