topic Re: unable to finish extracting fields in Splunk Search

unable to finish extracting fields

cybonet — Thu, 06 Apr 2017 06:42:33 GMT

Hi
I am new to splunk using it to collect syslog data, I started extracting fields after the 4 field I get this error:

Error in 'rex' command: regex="(?ms)^(?:[^=\n]*=){2}'(?P[^']+)[^\]\n]*\]='(?P[^']+)(?:[^=\n]*=){3}'(?P[^']+)(?:[^'\n]*'){8}(?P[^']+)" has exceeded configured match_limit, consider raising the value in limits.conf

the limits.conf is a read only file tried to understand where do I need to make the change but failed to....any help will be appriciated

Re: unable to finish extracting fields

richgalloway — Thu, 06 Apr 2017 11:52:19 GMT

Please post a sample event that is generating this error.

Re: unable to finish extracting fields

DMohn — Thu, 06 Apr 2017 13:11:51 GMT

Quoted from limits.conf Splunk documentation

match_limit = <integer>
* Limits the amount of resources that are spent by PCRE
  when running patterns that will not match.
* Use this to set an upper bound on how many times PCRE calls an internal
  function, match(). If set too low, PCRE might fail to correctly match a pattern.
* Default: 100000

This looks like you are trying to extract fields from a massive syslog statement. Normally, the default settings should be enough to extract multiple matches in your data.
You might consider checking your input data, if it gets split into individual events correctly.
What is your TRUNCATE setting on the sourcetype?
Furthermore, if you are unable to edit your limits.conf, you might be looking into the wrong file, or your user has no access rights to it. Where is the limits.conf you are trying to edit located?

Re: unable to finish extracting fields

cybonet — Tue, 29 Sep 2020 13:36:46 GMT

Error in 'rex' command: regex="(?ms)^(?:[^'\n]'){3}(?P[^']+)[^=\n]='(?P[^']+)(?:[^'\n]'){6}(?P[^']+)(?:[^=\n]=){4}'(?P\d+.\d+)" has exceeded configured match_limit, consider raising the value in limits.conf
Search results may be incomplete: the search process on the local peer:vpngw.pineapp.com ended prematurely. Please check the local peer log, such as $SPLUNK_HOME/var/log/splunk/splunkd.log and as well as the search.log for the particular search.
Select Fields

Highlight one or more values in the sample event to create fields. You can indicate one value is required, meaning it must exist in an event for the regular expression to match. Click on highlighted values in the sample event to modify them. To highlight text that is already part of an existing extraction, first turn off the existing extractions. Learn more
Apr 6 17:52:51 46.166.130.92 Apr 6 17:49:32 Mx4 pamsgprocess[13121]: [START] [MID]='9000000000002292032', [time]='2017-04-06 17:49:32.617832', [sender]='info@INHUMAN.nl', [subject]='(null)', [size]='4030', [source_ip]='14.186.113.222', [commtouch_ref]='SPAM, OK, (300)(1000)gggruggvucftvghtrhhoucdtuddrfeeliedrtdeggdeivdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfrkffpgfetrffrnecuuegrihhlohhuthemuceftddtnecujfgurhcugedtheeiucdlfedttddmnecujfgurhephffvufffgggtrfgikgfoqfesrgdttdepfidtnecuhfhrohhmpedfvfgrthihrghnrgdfuceoihhnfhhosefkpffjfgfotefprdhnlheqnecukfhppedugedrudekiedruddufedrvddvvd'[Content Filter]='Not Found', [MID]='9000000000002292032', [spam_score]='100.0 ', [type]='Spam', [status]='BLOCKED', [virus_details]='No Virus found', [direction]='R2L', [recipient]='emilya@ackerstein.co.il' [FINISH]

Re: unable to finish extracting fields

cybonet — Thu, 06 Apr 2017 15:06:24 GMT

Hi
the splunk is running on a centos 7 and me as root
where do I find the truncate value?
the syslog output is the standart I have been using another system graylog and it has no problem parsing the data
as for limits.conf that is what I have:
[root@vpngw ~]# locate limits.conf
/etc/security/limits.conf
/opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf
/opt/splunk/etc/system/README/limits.conf.example
/opt/splunk/etc/system/README/limits.conf.spec
/opt/splunk/etc/system/default/limits.conf
/usr/share/man/man5/limits.conf.5.gz
[root@vpngw ~]# ls -al /etc/security/limits.conf
-rw-r--r-- 1 root root 2422 Nov 6 01:14 /etc/security/limits.conf
[root@vpngw ~]# ls -al /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf
-r--r--r-- 1 splunk splunk 42 Mar 30 03:56 /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf
[root@vpngw ~]# ls -al /opt/splunk/etc/system/README/limits.conf.example
-r--r--r-- 1 splunk splunk 2970 Mar 30 03:56 /opt/splunk/etc/system/README/limits.conf.example
[root@vpngw ~]# ls -al /opt/splunk/etc/system/README/limits.conf.spec
-r--r--r-- 1 splunk splunk 94776 Mar 30 03:56 /opt/splunk/etc/system/README/limits.conf.spec
[root@vpngw ~]# ls -al /opt/splunk/etc/system/default/limits.conf
-r--r--r-- 1 splunk splunk 29990 Apr 6 09:15 /opt/splunk/etc/system/default/limits.conf

Re: unable to finish extracting fields

DMohn — Mon, 10 Apr 2017 12:54:33 GMT

You might not have touched your limits settings yet. Best practice might be to create your own settings app for this, or (which is not recommended in larger installations, but might suffice as a test) edit (or create) a limits.conf in /opt/splunk/etc/system/local/. If the file does not exist there only means that you did not chance any limits settings yet.

The value for truncate is set up in the file props.conf for the corresponding sourcetype (check this documentation here)

Re: unable to finish extracting fields

thirumal_nt — Thu, 29 Mar 2018 11:25:07 GMT

Does the setting work on Splunk 6.5.2 too as well...