TA for Symantec Endpoint Protection (syslog): "Bad regex value...two named subpatterns have the same name"

[pjohnson1]

We have installed the TA for Symantec Endpoint Protection (syslog) (https://splunkbase.splunk.com/app/3121/) and noticed upon restarting splunkd, we get the following error:

Bad regex value: '(?:[[sep_file_preifx]])\s*(?<Server_Name>[[sep_file_field]])\s*(?<Domain>[[sep_file_field]]),\s*(?<Server_Name>[[sep_file_field]]),\s*(?<Event_Description>[[sep_file_field]])', of param: transforms.conf / [field_extraction_for_scm_system] / REGEX; why: two named subpatterns have the same name One or more regexes in your configuration are not valid. For details, please see btool.log or directly above. Done

This is on 6.3.5.

[aholzel · Accepted solution]

you can change the regex, if you place "(?J)" (without the quotes) in front of the regex, duplicate field names are allowed.

[pjohnson1]

Thank you.

[abeeber_3]

I fixed it.

REGEX = (?J)(:[[sep_file_preifx]])\s*(?[[sep_file_field]])\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]])

I'm not getting the error anymore.

[ageld]

Thanks a lot!

[ageld]

Could you, please, elaborate more on this answer? Could you paste the actual REGEX here?

I could not fix the issue by placing (?J) after REGEX =

Thank you.

[abeeber_3]

Have you fixed the issue? I am having the same?

[ageld]

It has been a long while. I am not sure how exactly I fixed the issue. This is the statement I have now:

REGEX = (?:[[sep_file_preifx]])Site:\s(?P[[sep_file_field]]),\s*(?P[[sep_file_field]]),\s*(?P[[sep_file_field]]),\s*(?P[[sep_file_field]]),\s*(?P[[sep_file_field]]),\s*(?P[[sep_file_field]]),\s*(?P[[sep_file_field]])

It does not error out.

[abeeber_3]

ok.

I did the following:
REGEX = (?J)(:[[sep_file_preifx]])\s*(?[[sep_file_field]])\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]])