Splunk Search
Highlighted

How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

New Member

I am facing issue with regexes. Can any body help me resolving the errors below?

Checking conf files for problems...
                        Bad regex value: `(?i) document:(?P<peppol-out-file>[^ ]+)`, of param: props.conf / [peppol-outbound] / EXTRACT-peppol-out-file; why: syntax error in subpattern name (missing terminator)
                        Bad regex value: `(?i) Name:(?P<peppol-in-file>[^ ]+)`, of param: props.conf / [peppol-oxalis] / EXTRACT-peppol-in-file; why: syntax error in subpattern name (missing terminator)
                One or more regexes in your configuration are not valid. For details, please see btool.log or directly above.
Tags (3)
0 Karma
Highlighted

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

SplunkTrust
SplunkTrust

I think the hyphens in your field names are the problem. Try replacing them with underscores or removing them.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

New Member

But it is showing Missing Terminators.. Whats That..?

0 Karma
Highlighted

Re: How to resolve props.conf regex error "syntax error in subpattern name (missing terminator)"?

SplunkTrust
SplunkTrust

The missing terminator is either the '>' or ')' that is not found because the parser stopped at the '-' that doesn't belong there. It's a bad error message.

---
If this reply helps you, an upvote would be appreciated.
0 Karma