https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452321#M128067 <P>Are you using this regex on the search bar with the rex command? If so, you have to use max_match.</P> <P>The default for max_match is 1. Your regex is matching more than one value in an event. </P> <P>Set max_match=0 for unlimited matches.</P> Thu, 21 Mar 2019 19:02:03 GMT bcyates 2019-03-21T19:02:03Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452319#M128065 <P>Hello,</P> <P>I am getting this error in search head don't know why. Anybody had same issue please let me know.</P> <P>Thansk.</P> Thu, 21 Mar 2019 14:38:24 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452319#M128065 sathwikr076 2019-03-21T14:38:24Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452320#M128066 <P>Hi,</P> <P>Can you please provide some sample data (Mask sensitive data) and regex ?</P> Thu, 21 Mar 2019 14:50:11 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452320#M128066 harsmarvania57 2019-03-21T14:50:11Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452321#M128067 <P>Are you using this regex on the search bar with the rex command? If so, you have to use max_match.</P> <P>The default for max_match is 1. Your regex is matching more than one value in an event. </P> <P>Set max_match=0 for unlimited matches.</P> Thu, 21 Mar 2019 19:02:03 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452321#M128067 bcyates 2019-03-21T19:02:03Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452322#M128068 <P>Hi,</P> <P>Thanks for the reply but i am not using any regex which has that field. I checked everything on the search head.</P> Thu, 21 Mar 2019 19:34:58 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452322#M128068 sathwikr076 2019-03-21T19:34:58Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452323#M128069 <P>Same error here.<BR /> I can reproduce this error each time i refresh the job manager page<BR /> Splunk 7.2.5</P> Fri, 29 Mar 2019 08:58:14 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452323#M128069 C_HIEN 2019-03-29T08:58:14Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452324#M128070 <P>max_match is not really related to that error and will not solve it. If you get such an error when running regexes, it means your regex is poorly written and has too many matches (usually because of using stuff like <CODE>.*</CODE> and <CODE>.*?</CODE>, which cause the regex to match the string in many ways and require a lot of backtracking in the regex engine.<BR /> The solution is to write a better regex.</P> Fri, 29 Mar 2019 09:09:07 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452324#M128070 FrankVl 2019-03-29T09:09:07Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452325#M128071 <P>When / Where are you getting that error? If you're not actually doing a regex yourself, this is either a bug in splunk, or in some field extraction config or so in an add-on you have installed (although I'm not sure if that would result in errors presented in the GUI)?</P> Fri, 29 Mar 2019 09:11:23 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452325#M128071 FrankVl 2019-03-29T09:11:23Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452326#M128072 <P>Thanks for your reply. I think i have one regex which is matching many fields because of logs having different log pattern. </P> Wed, 03 Apr 2019 14:38:18 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452326#M128072 sathwikr076 2019-04-03T14:38:18Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452327#M128073 <P>Did you ever figure this out? We are seeing the exact same error message in our splunkd log.</P> Tue, 04 Jun 2019 17:03:29 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452327#M128073 robert_miller 2019-06-04T17:03:29Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452328#M128074 <P>Same error for us and we are running 7.2.4. Maybe this is an issue with 7.2.x.</P> Tue, 04 Jun 2019 19:05:57 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452328#M128074 robert_miller 2019-06-04T19:05:57Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452329#M128075 <P>When and where are you getting that error?</P> Wed, 05 Jun 2019 12:40:20 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452329#M128075 FrankVl 2019-06-05T12:40:20Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452330#M128076 <P>I see this error on our SH running Enterprise Security.</P> Wed, 05 Jun 2019 20:02:21 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452330#M128076 robert_miller 2019-06-05T20:02:21Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452331#M128077 <P>But where and when specifically? On which page / after doing what kind of action (e.g. is it with running a specific search, or upon visiting a certain page / dashboard /...).</P> Thu, 06 Jun 2019 07:33:35 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452331#M128077 FrankVl 2019-06-06T07:33:35Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452332#M128078 <P>How do we fix this in the jobs page?</P> <P>/en-US/app/SplunkEnterpriseSecuritySuite/job_manager</P> Mon, 10 Jun 2019 18:27:49 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452332#M128078 tommoore 2019-06-10T18:27:49Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452333#M128079 <P>It does appear to be when I go to the job_manager. Looks like @tommoore and I have the same issue.</P> Mon, 10 Jun 2019 19:05:10 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452333#M128079 robert_miller 2019-06-10T19:05:10Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452334#M128080 <P>Sounds like a bug then, which is probably best raised with Splunk Support.</P> Tue, 11 Jun 2019 08:00:47 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452334#M128080 FrankVl 2019-06-11T08:00:47Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452335#M128081 <P>I just heard from support about this issue, and its a known bug (internal bug SPL-160983) that they have decided to not fix. There is no impact to the system and there isn't a way to stop the error from triggering. Support said to ignore these errors going forward.</P> Mon, 01 Jul 2019 17:36:57 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452335#M128081 robert_miller 2019-07-01T17:36:57Z https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452336#M128082 <P>We have the same thing here. The regex itself seems working fine. It seems just another annoying error which could be safely ignore. </P> <P>I think the resolution is to write a less greedy regex.</P> Tue, 23 Jul 2019 23:31:15 GMT https://community.splunk.com/t5/Splunk-Search/ERROR-Regex-Failed-in-pcre-exec-Error-PCRE-ERROR-MATCHLIMIT-for/m-p/452336#M128082 season88481 2019-07-23T23:31:15Z