https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418702#M172759 <P>thank you vey much. It runs</P> Fri, 08 Mar 2019 14:36:59 GMT tulusoy 2019-03-08T14:36:59Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418697#M172754 <P>Hi,<BR /> I have a search with regex </P> <PRE><CODE>ERROR * | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats sparkline count by exception |sort count desc </CODE></PRE> <P>should I change limits.conf or change regex ?<BR /> Can you help me.</P> <P>Thank you</P> Fri, 01 Mar 2019 12:33:13 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418697#M172754 tulusoy 2019-03-01T12:33:13Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418698#M172755 <P>@tulusoy while posting code use the code button ( <CODE>101010</CODE> ) on Splunk Answers so that special characters do not escape.</P> <PRE><CODE>You can also use shortcut Ctrl+K after selecting the code. </CODE></PRE> <P>Or else add four spaces before each line of code and ensure to hit enter twice before writing first line of code so that there is a line gap between text and code. (Usually preview mode on Splunk Answer shows you how your final post will appear after submit.)</P> Fri, 01 Mar 2019 13:02:10 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418698#M172755 niketn 2019-03-01T13:02:10Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418699#M172756 <P>Could you provide a sample positive event ? Btw. your regex is broken...</P> Fri, 01 Mar 2019 18:46:18 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418699#M172756 damann 2019-03-01T18:46:18Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418700#M172757 <P>What's the problem here? </P> Fri, 01 Mar 2019 19:56:09 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418700#M172757 somesoni2 2019-03-01T19:56:09Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418701#M172758 <P>Try this:</P> <P><CODE>ERROR * | rex "(?&lt;exception&gt;\S+Exception)" | stats sparkline count by exception |sort count desc</CODE></P> Fri, 01 Mar 2019 20:00:25 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418701#M172758 chrisyounger 2019-03-01T20:00:25Z https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418702#M172759 <P>thank you vey much. It runs</P> Fri, 08 Mar 2019 14:36:59 GMT https://community.splunk.com/t5/Splunk-Search/can-you-help-me-with-regex/m-p/418702#M172759 tulusoy 2019-03-08T14:36:59Z