Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.conf.

[restinlinux]

Rex error while extracting fields with delimiter Commas...

For lot of the field it is NULL ( field1=NULL , field2=Null ...field4=value..)

Why is rex error is occuring !

Error message : has exceeded the configured depth_limit, consider raising the value in limits.conf.

whats the solution to resolve this !!

[ITWhisperer]

What is the configuration you are using?

[restinlinux]

I have integrated some log in Splunk...

Need to extract the fields

The log has two different set of  events

Using the Regular expression i have tried to extract the field ..

the Regular expression pick the field name and the value correctly on one set of events..

but for the another set of event the expected field name and value is not extracting properly.....

Sample log:

test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

[ITWhisperer]

What is the regex you are using?

Which log events are not being extracted correctly?

[inventsekar]

Please try this:
| extract pairdelim="\"{,}" kvdelim=":"

[restinlinux]

it didn't worked XD..

let me brief in detail !!

Look at the Sample log:

Event1: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

Event2:  test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"

if trying to extracting the field Splunk (set as required) with its value "siem" from the above log

the field is perfectly extracted in event 1with its correct value siem but in the second event the field  splunk is extracted where the value is keypair not siem...

Add tags

[inventsekar]

sorry, pls try this:

| extract pairdelim="\"{,}" kvdelim="="