All Apps and Add-ons

How to reduce rex usage in query results in exceeding the depth limit of REGEX?

valadasr
Explorer

Hello,

I've been tasked to optimize a former colleague's saved searches and found that the query had a lot of rex command going at the same field and decided to compact into one REGEX

As such, i've applied the following REGEX:

valadasr_0-1661980146731.png

From Regex101, i've had the query with a whopping 6.5k steps which is a bit too much, and i've been trying to reduce it as much as i can but i've lack knowledge in that department in order to optimize further the query.

One of the things that i want to keep only are the capture groups but the rest i want to ignore altogether. Is there a way of doing that and reducing the steps?

https://regex101.com/r/qDy1Lr/4

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this is an instance where "optimizing" is not optimal.  While a clever person such as yourself may be able to craft an amazing regular expression that is the equivalent of the many regexes your former coworker used, that doesn't make it better.  As you're discovering, such a regex may require many more steps and more resources than the many regexes it replaces.  Consider also the person who will replace you and have to maintain your creation.  Will he or she be able to understand it enough to adapt it to a changing data source?  In six months time, will *you* be able to understand it enough to adapt it to a changing data source?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...