topic Maximum number of attribute $n in transforms.conf in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Maximum-number-of-attribute-n-in-transforms-conf/m-p/258082#M49582 <P>Hello,<BR /> the FORMAT option in transforms.conf can use $n to specify the output of each REGEX match.<BR /> (<A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf</A>)</P> <PRE><CODE>FORMAT = &lt;string&gt; (* snip *) * FORMAT for index-time extractions: * Use $n (for example $1, $2, etc) to specify the output of each REGE match. </CODE></PRE> <P>Is there a hard limit on the maximum number of attribute $n in transforms.conf?</P> Tue, 24 Jan 2017 08:37:59 GMT CurryPan 2017-01-24T08:37:59Z Maximum number of attribute $n in transforms.conf https://community.splunk.com/t5/Getting-Data-In/Maximum-number-of-attribute-n-in-transforms-conf/m-p/258082#M49582 <P>Hello,<BR /> the FORMAT option in transforms.conf can use $n to specify the output of each REGEX match.<BR /> (<A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf</A>)</P> <PRE><CODE>FORMAT = &lt;string&gt; (* snip *) * FORMAT for index-time extractions: * Use $n (for example $1, $2, etc) to specify the output of each REGE match. </CODE></PRE> <P>Is there a hard limit on the maximum number of attribute $n in transforms.conf?</P> Tue, 24 Jan 2017 08:37:59 GMT https://community.splunk.com/t5/Getting-Data-In/Maximum-number-of-attribute-n-in-transforms-conf/m-p/258082#M49582 CurryPan 2017-01-24T08:37:59Z Re: Maximum number of attribute $n in transforms.conf https://community.splunk.com/t5/Getting-Data-In/Maximum-number-of-attribute-n-in-transforms-conf/m-p/258083#M49583 <P>There is a hard limit of 65535 imposed by PCRE2 library:</P> <P>There is no limit to the number of parenthesized subpatterns, but there can be no more than 65535 capturing subpatterns.<BR /> (<A href="http://www.pcre.org/current/doc/html/pcre2limits.html">http://www.pcre.org/current/doc/html/pcre2limits.html</A>)</P> Tue, 24 Jan 2017 08:38:50 GMT https://community.splunk.com/t5/Getting-Data-In/Maximum-number-of-attribute-n-in-transforms-conf/m-p/258083#M49583 CurryPan 2017-01-24T08:38:50Z