topic Re: Field extractor is unusually slow (max single event time=, probes=warning max=) in Splunk Search

Field extractor is unusually slow (max single event time=, probes=warning max=)

royimad — Fri, 12 Apr 2013 06:57:01 GMT

I have a regular expression that extract everything that exist between brackets
Extraction:

(?i) .*?   (?P<METHOD>\-\s+\[\w+.*.\])\s+\w+

I'm receiving the following Warning
Field extractor name=EXTRACT-METHOD is unusually slow (max single event time=1081ms, probes=5 warning max=1000ms)

kristian_kolb — Fri, 12 Apr 2013 07:44:46 GMT

That regex does look a bit odd to me. If you have an event like:

blah blah [yohoo_123] blah blah

and just want to extract yohoo_123 your regex should probably look more like;

...| rex "\[(?<METHOD>[^\]]+)\]"

i.e. after the opening square bracket, grab everything that is NOT a closing square bracket, followed by a closing square bracket.

royimad — Fri, 12 Apr 2013 07:59:08 GMT

perfect dude:)

royimad — Fri, 12 Apr 2013 08:06:41 GMT

How to put that in props.conf

royimad — Fri, 12 Apr 2013 08:09:40 GMT

I need that METHOD field will be persistent

kristian_kolb — Fri, 12 Apr 2013 08:16:33 GMT

Should work.

props.conf
[your_sourcetype]
EXTRACT-blah = \s\[(?<METHOD>[^\]]+)\]\s