error regex (PCRE2_DUPNAMES not set)

[daluoc]

when I start splunk it shows me his " Checking conf files for problems...
Bad regex value: '(?:[[sep_file_preifx]])\s*(?[[sep_file_field]])\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]])', of param: transforms.conf / [field_extraction_for_scm_system] / REGEX; why: two named subpatterns have the same name (PCRE2_DUPNAMES not set)
One or more regexes in your configuration are not valid. For details, please see btool.log or directly above."

and I do not understand the error.

Can you help me please ?

[cdstealer]

Hi daluoc,
You can't specify the extracted field name more than once. So you would need to specify each condition followed by the field extraction.
eg
(no\sIKE\sconfig\sfound\sfor\s\d+\.\d+\.\d+\.\d+\.\.\.|received\sinvalid\sIKE\sheader\sfrom\s)(?P<unauthorized>[^(,|\s)]+)

(no\sIKE\sconfig\sfound\sfor\s\d+\.\d+\.\d+\.\d+\.\.\. is the first condition. Then add a "|" as a separator and then
received\sinvalid\sIKE\sheader\sfrom\s) as the second then followed by the extraction
(?P<unauthorized>[^(,|\s)]+)

You can | numerous conditions together and they will populate the same field.

Hope that makes sense. Also apologies for the necropost 😉

[cpetterborg]

I'm not sure all the data from the error message came through, because it isn't a valid regular expression. You may want to paste the data back in, and use the 101010 button to make sure that all the data comes through properly.

As a possible solution, you may wish to add (?J) to the from of your regular expression, which may fix the problem. Try that first and see if it fixes things for you.