All Apps and Add-ons

TA-juniper "Bad regex value" error after upgrade from Splunk 6.2.6 to 6.3.5

pjohnson1
Path Finder

Hello,

After we upgraded Splunk to 6.3.5, our TA-juniper started producing a bad regex error:

btool.log

Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: in valid range in character class

transforms.conf

[dvc_for_junos_fw]
REGEX = \s+([.-\w]+)\s+RT_FLOW
FORMAT = dvc::$1

Could someone please shed some light on this?

Thanks.

1 Solution

twinspop
Influencer

Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:

 [dvc_for_junos_fw]
 REGEX = \s+([-.\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

View solution in original post

michael_sleep
Communicator

Like Twinspop mentioned it's the hyphen but you don't have to move it, you can escape it with a backslash:

 [dvc_for_junos_fw]
 REGEX = \s+([.\-\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

twinspop
Influencer

Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:

 [dvc_for_junos_fw]
 REGEX = \s+([-.\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

pjohnson1
Path Finder

Thank you!

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...