search

deductiv / kvstore_tools

KV Store Tools Redux app for Splunk
https://www.deductiv.net
Other
3 stars 6 forks source link

Invalid stanza in props.conf #2

Closed nts-jkaufmann closed 2 years ago

nts-jkaufmann commented 2 years ago

Hi,

I saw that the following stanzas have been added to default/props.conf in the newest release:

[source::.../var/log/splunk/kvstore_tools.log]
sourcetype = kvstore_tools

[source::...\var\log\splunk\kvstore_tools.log]
sourcetype = kvstore_tools

The second stanza is invalid and throws an error at splunkd restarts:

Bad regex value: 'source::...\var\log\splunk\kvstore_tools.log', of param: props.conf / [source::...\var\log\splunk\kvstore_tools.log]; why: PCRE does not support \L, \l, \N{name}, \U, or \u

The source stanza is a regex field, which is why it throws an error:

When setting a [<spec>] stanza, you can use the following regex-type syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

Regards, Julian