Splunk Search

error regex (PCRE2_DUPNAMES not set)

daluoc
New Member

when I start splunk it shows me his " Checking conf files for problems...
Bad regex value: '(?:[[sep_file_preifx]])\s*(?[[sep_file_field]])\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]]),\s*(?[[sep_file_field]])', of param: transforms.conf / [field_extraction_for_scm_system] / REGEX; why: two named subpatterns have the same name (PCRE2_DUPNAMES not set)
One or more regexes in your configuration are not valid. For details, please see btool.log or directly above."

and I do not understand the error.

Can you help me please ?

0 Karma

cdstealer
Contributor

Hi daluoc,
You can't specify the extracted field name more than once. So you would need to specify each condition followed by the field extraction.
eg
(no\sIKE\sconfig\sfound\sfor\s\d+\.\d+\.\d+\.\d+\.\.\.|received\sinvalid\sIKE\sheader\sfrom\s)(?P<unauthorized>[^(,|\s)]+)

(no\sIKE\sconfig\sfound\sfor\s\d+\.\d+\.\d+\.\d+\.\.\. is the first condition. Then add a "|" as a separator and then
received\sinvalid\sIKE\sheader\sfrom\s) as the second then followed by the extraction
(?P<unauthorized>[^(,|\s)]+)

You can | numerous conditions together and they will populate the same field.

Hope that makes sense. Also apologies for the necropost 😉

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'm not sure all the data from the error message came through, because it isn't a valid regular expression. You may want to paste the data back in, and use the 101010 button to make sure that all the data comes through properly.

As a possible solution, you may wish to add (?J) to the from of your regular expression, which may fix the problem. Try that first and see if it fixes things for you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...