Getting Data In

Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

nareerat_pr
Explorer

I found many errors from _internal log

ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-regmon.exesplunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

Any ideas how to resolve this error?

0 Karma

Stefanie
Builder

Do you have any REGEX in your inputs.conf ? That's where I would look first.

0 Karma

nareerat_pr
Explorer

there are no any REGEX

this is my inputs.conf on uf

nareerat_pr_0-1650535329103.png

 

0 Karma

Stefanie
Builder

And that's the only inputs.conf located on your UF? Splunk-regmon is trying to be ran from some configuration. Were you actively monitoring the registry before this error started to pop up?

 

Take a look at this article: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowsregistrydata

The inputs.conf file contains the specific regular expressions you create to refine and filter the Registry hive paths you want the Splunk platform to monitor.

 

It could be that the app is looking at the wrong inputs.conf and getting confused. 

Try running this command to look through all of your inputs.confs

D:\SplunkUniversalForwarder\bin\splunk.exe btool inputs list > ..\btool.txt

It will create a txt file for you to go through.

 

 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...