configured match_limit, consider raising the value in limits.conf

[amanthri]

Splunk ITSI is not able create the service now tickets whenever we have seen longer comments in the work notes section . 
We haven't made any changes recently but the below error is popping up .Any clue why is this happening ?

Seeing this Streamed search execute failed because: Error in 'rex' command: regex="(?s).*dv_comments="(?<comments>.*)$" has exceeded configured match_limit, consider raising the value in limits.conf.

Here's the regex expression :

rex field=_raw "(?s).*dv_comments=\"(?<comments>.*)$"
rex field=comments "(?s)(?<comment_time>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\s-\s(?<comment_user>.*?)\s\(Additional comments\)\n\sResolution notes\s=\s(?<resolution_notes>.*?)(?=\d{4}-\d{2}-\d{2}|\n\"|$).*"

what is the default value to set in limits.conf?
what happens if we set it to default values in itsi event correlation  and alternative suggestions ?

[livehybrid]

Hi @amanthri 

Your first regex is greedy .* at the start matches the entire event, causing backtracking on long inputs. Make it non-greedy or anchor better using something like the following:

rex field=_raw "dv_comments=\"(?<comments>[^\"]*)"

The default value is 10000. Check out https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/9.4/configuration-file-refere

nce/9.4.3-configuration-file-reference/limits.conf

[rex]
match_limit = <integer>
* Limits the amount of resources that are spent by PCRE
when running patterns that will not match.
* Use this to set an upper bound on how many times PCRE calls an internal
function, match(). If set too low, PCRE might fail to correctly match
a pattern.
* Default: 100000

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing