Splunk Search

How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

Amandeepsin
New Member

I am facing issue with regexes. Can any body help me resolving the errors below?

Checking conf files for problems...
                        Bad regex value: `(?i) document:(?P<peppol-out-file>[^ ]+)`, of param: props.conf / [peppol-outbound] / EXTRACT-peppol-out-file; why: syntax error in subpattern name (missing terminator)
                        Bad regex value: `(?i) Name:(?P<peppol-in-file>[^ ]+)`, of param: props.conf / [peppol-oxalis] / EXTRACT-peppol-in-file; why: syntax error in subpattern name (missing terminator)
                One or more regexes in your configuration are not valid. For details, please see btool.log or directly above.
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think the hyphens in your field names are the problem. Try replacing them with underscores or removing them.

---
If this reply helps you, Karma would be appreciated.

Amandeepsin
New Member

But it is showing Missing Terminators.. Whats That..?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The missing terminator is either the '>' or ')' that is not found because the parser stopped at the '-' that doesn't belong there. It's a bad error message.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...