topic Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co in Splunk Enterprise

Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.conf.

restinlinux — Wed, 28 Sep 2022 05:14:47 GMT

Rex error while extracting fields with delimiter Commas...

For lot of the field it is NULL ( field1=NULL , field2=Null ...field4=value..)

Why is rex error is occuring !

Error message : has exceeded the configured depth_limit, consider raising the value in limits.conf.

whats the solution to resolve this !!

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

ITWhisperer — Wed, 28 Sep 2022 07:34:19 GMT

What is the configuration you are using?

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

restinlinux — Wed, 28 Sep 2022 09:23:02 GMT

I have integrated some log in Splunk...

Need to extract the fields

The log has two different set of events

Using the Regular expression i have tried to extract the field ..

the Regular expression pick the field name and the value correctly on one set of events..

but for the another set of event the expected field name and value is not extracting properly.....

Sample log:

test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

inventsekar — Wed, 28 Sep 2022 09:38:06 GMT

Please try this:
| extract pairdelim="\"{,}" kvdelim=":"

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

ITWhisperer — Wed, 28 Sep 2022 09:49:18 GMT

What is the regex you are using?

Which log events are not being extracted correctly?

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

restinlinux — Wed, 28 Sep 2022 09:51:26 GMT

it didn't worked XD..

let me brief in detail !!

Look at the Sample log:

Event1: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

Event2: test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"

if trying to extracting the field Splunk (set as required) with its value "siem" from the above log

the field is perfectly extracted in event 1with its correct value siem but in the second event the field splunk is extracted where the value is keypair not siem...

Add tags

Re: Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.co

inventsekar — Wed, 28 Sep 2022 10:26:33 GMT

sorry, pls try this:

| extract pairdelim="\"{,}" kvdelim="="