Getting Data In

Error: WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

nareerat_pr
Explorer

I found many errors from _internal log

ERROR ExecProcessor - message from "D:\SplunkUniversalForwarder\bin\splunk-regmon.exesplunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: number too big in {} quantifier'

Any ideas how to resolve this error?

0 Karma

Stefanie
Builder

Do you have any REGEX in your inputs.conf ? That's where I would look first.

0 Karma

nareerat_pr
Explorer

there are no any REGEX

this is my inputs.conf on uf

nareerat_pr_0-1650535329103.png

 

0 Karma

Stefanie
Builder

And that's the only inputs.conf located on your UF? Splunk-regmon is trying to be ran from some configuration. Were you actively monitoring the registry before this error started to pop up?

 

Take a look at this article: https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/MonitorWindowsregistrydata

The inputs.conf file contains the specific regular expressions you create to refine and filter the Registry hive paths you want the Splunk platform to monitor.

 

It could be that the app is looking at the wrong inputs.conf and getting confused. 

Try running this command to look through all of your inputs.confs

D:\SplunkUniversalForwarder\bin\splunk.exe btool inputs list > ..\btool.txt

It will create a txt file for you to go through.

 

 

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...