How to resolve "Bad regex value" error in transforms.conf?

[Waltersr24]

Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: invalid range in character class

Has anybody else had the same errors? if so, what was your solution?

[somesoni2]

As the error indicates, for stanza dvc_for_junos_fw, the REGEX attribute set in transforms.conf is invalid. So, you need to correct the regular expression. Easiest way to validate if a regex is valid or not is to use https://regex101.com/ or similar tool. Based on my testing, you need to escape the hyphen with backslash. (use \s+([.\-\w]+)\s+RT_FLOW instead of \s+([.-\w]+)\s+RT_FLOW)

[Waltersr24]

which transforms.conf file would i need to change? i'm pretty new to Splunk and still learning alot of the basics .