Getting Data In

Regex error when extracting fields as delimiter.

jbender72
Path Finder

Hello,

 

Trying to renames fields for CIM compliance, and I see this pop up when trying to rename via deliminer.  Any field I try I get this warning.  Although it lets me save?

jbender72_0-1610643546849.png

Thanks

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jbender72,

I think it is complaining because of too many fields for delimiters. You can try EVAL or FIELDALIAS to create CIM compaint field on your sourcetype like below;

EVAL-src=srcip
or
FIELDALIAS-src=srcip AS src

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

That's one humungous regex! Your regex is doing a lot of lookahead/backtracking, so it's hitting the limits, see

https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Limitsconf

options are to split up your rex or to find an more efficient way to CIM map/extract the fields 😞

 

jbender72
Path Finder

That's what I mean, this just popped up out of "nowhere", looking for a solution.  I will look into limits.conf  thank you.

 

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @jbender72,

I think it is complaining because of too many fields for delimiters. You can try EVAL or FIELDALIAS to create CIM compaint field on your sourcetype like below;

EVAL-src=srcip
or
FIELDALIAS-src=srcip AS src

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...