All Apps and Add-ons

How to reduce rex usage in query results in exceeding the depth limit of REGEX?

valadasr
Explorer

Hello,

I've been tasked to optimize a former colleague's saved searches and found that the query had a lot of rex command going at the same field and decided to compact into one REGEX

As such, i've applied the following REGEX:

valadasr_0-1661980146731.png

From Regex101, i've had the query with a whopping 6.5k steps which is a bit too much, and i've been trying to reduce it as much as i can but i've lack knowledge in that department in order to optimize further the query.

One of the things that i want to keep only are the capture groups but the rest i want to ignore altogether. Is there a way of doing that and reducing the steps?

https://regex101.com/r/qDy1Lr/4

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think this is an instance where "optimizing" is not optimal.  While a clever person such as yourself may be able to craft an amazing regular expression that is the equivalent of the many regexes your former coworker used, that doesn't make it better.  As you're discovering, such a regex may require many more steps and more resources than the many regexes it replaces.  Consider also the person who will replace you and have to maintain your creation.  Will he or she be able to understand it enough to adapt it to a changing data source?  In six months time, will *you* be able to understand it enough to adapt it to a changing data source?

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...