Bad regex value: '\s+([.-\w]+)\s+RT_FLOW', of param: transforms.conf / [dvc_for_junos_fw] / REGEX; why: invalid range in character class
Has anybody else had the same errors? if so, what was your solution?
As the error indicates, for stanza dvc_for_junos_fw
, the REGEX attribute set in transforms.conf is invalid. So, you need to correct the regular expression. Easiest way to validate if a regex is valid or not is to use https://regex101.com/ or similar tool. Based on my testing, you need to escape the hyphen with backslash. (use \s+([.\-\w]+)\s+RT_FLOW
instead of \s+([.-\w]+)\s+RT_FLOW
)
which transforms.conf file would i need to change? i'm pretty new to Splunk and still learning alot of the basics .