All Apps and Add-ons

TA-juniper "Bad regex value" error after upgrade from Splunk 6.2.6 to 6.3.5

pjohnson1
Path Finder

Hello,

After we upgraded Splunk to 6.3.5, our TA-juniper started producing a bad regex error:

btool.log

Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: in valid range in character class

transforms.conf

[dvc_for_junos_fw]
REGEX = \s+([.-\w]+)\s+RT_FLOW
FORMAT = dvc::$1

Could someone please shed some light on this?

Thanks.

1 Solution

twinspop
Influencer

Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:

 [dvc_for_junos_fw]
 REGEX = \s+([-.\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

View solution in original post

michael_sleep
Communicator

Like Twinspop mentioned it's the hyphen but you don't have to move it, you can escape it with a backslash:

 [dvc_for_junos_fw]
 REGEX = \s+([.\-\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

twinspop
Influencer

Character classes are in square brackets. If you have a hyphen in the middle of the class, it thinks you want a range. You need to move the hyphen to the front of the class:

 [dvc_for_junos_fw]
 REGEX = \s+([-.\w]+)\s+RT_FLOW
 FORMAT = dvc::$1

pjohnson1
Path Finder

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...