Hello I have the following regex from cisco asa add-on default transforms.conf: [cisco_source_ipv4] REGEX = \s+(?:from|for|src(?! user)) (?:(\S+):)[\w-]*?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})(?:\/(\w+))?(?:\((?:([\S^\\]+)\\)?([\w\-_]+)\))?\s*\(?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})?\/?(\d+)?\)?\s*(?:\((?:([\S^\\]+)\\)?([\w\-_]+)\))? FORMAT = src_zone::$1 src_ip::$2 src_port::$3 src_nt_domain::$4 src_user::$5 src_translated_ip::$6 src_translated_port::$7 src_nt_domain::$8 src_user::$9 The issue is that If I try to run the regex from UI, I get error : Error in 'SearchOperator:regex': The regex '\s+(?:from|for|src(?! user)) (?:(\S+):)[\w-]*?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})(?:\/(\w+))?(?:\((?:([\S^\]+)\)?([\w\-_]+)\))?\s*\(?(\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3})?\/?(\d+)?\)?\s*(?:\((?:([\S^\]+)\)?([\w\-_]+)\))?' is invalid. Regex: missing closing parenthesis. The add-on is working fine as well as search time field extraction so obviously the regex is working fine from transforms.conf but not in UI using regex command. Someone can help?
... View more