topic Re: Optimize Regex in Splunk Search

Optimize Regex

secphilomath1 — Fri, 01 Mar 2024 00:52:21 GMT

I am getting an error when using the following regex

(?<=on\s)(.*)(?=\sby Firewall Settings)

The error is "Error in 'rex' command: regex="(?<=on\s)(.*)(?<HostName>.*)(?=\sby Firewall Settings)" has exceeded configured match_limit, consider raising the value in limits.conf."

Is there a better way to do this, I am trying to find all text between "on " and " by Firewall Settings. It works in regex101.com, but I get that error in Splunk.

TIA!

Re: Optimize Regex

richgalloway — Fri, 01 Mar 2024 01:13:24 GMT

It would help to have a sample (sanitized) event to work with.

Avoid lookbehind and lookahead in Splunk. They're costly and rarely necessary. Try

on\s(?<HostName>\S*)\sby Firewall Settings

Re: Optimize Regex

secphilomath1 — Fri, 01 Mar 2024 17:25:25 GMT

Good to know, thanks, works perfectly.