Splunk Enterprise

Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.conf.

restinlinux
Explorer

Rex error while extracting fields with delimiter Commas...

For lot of the field it is NULL ( field1=NULL , field2=Null ...field4=value..)

Why is rex error is occuring !

Error message : has exceeded the configured depth_limit, consider raising the value in limits.conf.

whats the solution to resolve this !!

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the configuration you are using?

0 Karma

restinlinux
Explorer

I have integrated some log in Splunk...

Need to extract the fields

The log has two different set of  events

Using the Regular expression i have tried to extract the field ..

the Regular expression pick the field name and the value correctly on one set of events..

but for the another set of event the expected field name and value is not extracting properly.....

 

Sample log:

test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

ITWhisperer
SplunkTrust
SplunkTrust

What is the regex you are using?

Which log events are not being extracted correctly?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please try this:
| extract pairdelim="\"{,}" kvdelim=":"

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

restinlinux
Explorer

it didn't worked XD..

let me brief in detail !!

Look at the Sample log:

Event1: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"


Event2:  test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"

if trying to extracting the field Splunk (set as required) with its value "siem" from the above log

the field is perfectly extracted in event 1with its correct value siem but in the second event the field  splunk is extracted where the value is keypair not siem...

 

 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

sorry, pls try this:

| extract pairdelim="\"{,}" kvdelim="="

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...