Splunk Enterprise

Rex error while field extraction - has exceeded the configured depth_limit, consider raising the value in limits.conf.

restinlinux
Explorer

Rex error while extracting fields with delimiter Commas...

For lot of the field it is NULL ( field1=NULL , field2=Null ...field4=value..)

Why is rex error is occuring !

Error message : has exceeded the configured depth_limit, consider raising the value in limits.conf.

whats the solution to resolve this !!

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the configuration you are using?

0 Karma

restinlinux
Explorer

I have integrated some log in Splunk...

Need to extract the fields

The log has two different set of  events

Using the Regular expression i have tried to extract the field ..

the Regular expression pick the field name and the value correctly on one set of events..

but for the another set of event the expected field name and value is not extracting properly.....

 

Sample log:

test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"
test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"

ITWhisperer
SplunkTrust
SplunkTrust

What is the regex you are using?

Which log events are not being extracted correctly?

0 Karma

inventsekar
Super Champion

Please try this:
| extract pairdelim="\"{,}" kvdelim=":"

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

restinlinux
Explorer

it didn't worked XD..

let me brief in detail !!

Look at the Sample log:

Event1: test="2",hi="hi",splunk="siem",best="you",Karma="sure",thank="you"


Event2:  test="2",hi="hi",field="keypair",splunk="siem",best="you",Karma="sure",thank="you"

if trying to extracting the field Splunk (set as required) with its value "siem" from the above log

the field is perfectly extracted in event 1with its correct value siem but in the second event the field  splunk is extracted where the value is keypair not siem...

 

 

0 Karma

inventsekar
Super Champion

sorry, pls try this:

| extract pairdelim="\"{,}" kvdelim="="

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...