Hello,
After we upgraded Splunk to 6.3.5, our TA-juniper started producing a bad regex error:
btool.log
Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: in valid range in character class
transforms.conf
[dvc_for_junos_fw]
REGEX = \s+([.-\w]+)\s+RT_FLOW
FORMAT = dvc::$1
Could someone please shed some light on this?
Thanks.
Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:
[dvc_for_junos_fw]
REGEX = \s+([-.\w]+)\s+RT_FLOW
FORMAT = dvc::$1
Like Twinspop mentioned it's the hyphen but you don't have to move it, you can escape it with a backslash:
[dvc_for_junos_fw]
REGEX = \s+([.\-\w]+)\s+RT_FLOW
FORMAT = dvc::$1
Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:
[dvc_for_junos_fw]
REGEX = \s+([-.\w]+)\s+RT_FLOW
FORMAT = dvc::$1
Thank you!