All Apps and Add-ons

How to reduce rex usage in query results in exceeding the depth limit of REGEX?

valadasr
Explorer

Hello,

I've been tasked to optimize a former colleague's saved searches and found that the query had a lot of rex command going at the same field and decided to compact into one REGEX

As such, i've applied the following REGEX:

valadasr_0-1661980146731.png

From Regex101, i've had the query with a whopping 6.5k steps which is a bit too much, and i've been trying to reduce it as much as i can but i've lack knowledge in that department in order to optimize further the query.

One of the things that i want to keep only are the capture groups but the rest i want to ignore altogether. Is there a way of doing that and reducing the steps?

https://regex101.com/r/qDy1Lr/4

Labels (3)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this is an instance where "optimizing" is not optimal.  While a clever person such as yourself may be able to craft an amazing regular expression that is the equivalent of the many regexes your former coworker used, that doesn't make it better.  As you're discovering, such a regex may require many more steps and more resources than the many regexes it replaces.  Consider also the person who will replace you and have to maintain your creation.  Will he or she be able to understand it enough to adapt it to a changing data source?  In six months time, will *you* be able to understand it enough to adapt it to a changing data source?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...