topic field Extraction in Splunk Search

field Extraction

christian75 — Fri, 14 May 2021 12:43:38 GMT

When i want to extract BiosMake fields with fields extraction.I have this error:

Error in 'rex' command

aasabatini — Fri, 14 May 2021 12:48:31 GMT

please share a set of data and your rex expression because with less information we can't help

Regards

Ale

gcusello — Fri, 14 May 2021 12:48:53 GMT

at first what's your error? "Rex has exceeded configured match_limit"?

You are receiving this error becuase your regular expression takes a lot of steps to try and match your events.

Sharing your regex and a sample of your logs we'd help you.

Ciao.

Giuseppe

christian75 — Tue, 18 May 2021 10:31:35 GMT

Thanks I have my answer

christian75 — Tue, 18 May 2021 10:32:47 GMT

Thanks I have my answer

gcusello — Tue, 18 May 2021 11:00:43 GMT

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉