TA-juniper "Bad regex value" error after upgrade from Splunk 6.2.6 to 6.3.5

[pjohnson1]

Hello,

After we upgraded Splunk to 6.3.5, our TA-juniper started producing a bad regex error:

btool.log

Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: in valid range in character class

transforms.conf

[dvc_for_junos_fw]
REGEX = \s+([.-\w]+)\s+RT_FLOW
FORMAT = dvc::$1

Could someone please shed some light on this?

Thanks.

[michael_sleep]

Like Twinspop mentioned it's the hyphen but you don't have to move it, you can escape it with a backslash:

 [dvc_for_junos_fw]
 REGEX = \s+([.\-\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

[twinspop · Accepted solution]

Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:

 [dvc_for_junos_fw]
 REGEX = \s+([-.\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

[pjohnson1]

Thank you!