Splunk Search

Error: has exceeded configured match_limit

ivana27
Path Finder

Hi all,

please can you help to solve this error by modifying rex line. Here is my error:

Error in 'rex' command: regex="[^,]+\:\s(?<Result>[^,]+)\,[^,]+\:\s(?<CardTyp>[^,]+|)\,[^,]+\:\s(?<TxTyp>[^,]+)\,[^,]+\:\s(?<Amount>[^,]+|)\,[^,]+\:\s(?<CardTech>[^,]+|)\,[^,]+\:\s(?<TerminalId>[^,]+|)\,[^,]+\:\s(?<TxDtTm>[^,]+|)\,[^,]+\:\s(?<AquirNm>[^,]+|)\,[^,]+\:\s(?<CardNu>[^,]+|)\,[^,]+\:\s(?<Merchant>[^,]+|)\,[^,]+\:\s(?<ExtraData>\[.*?\]|)\,[^,]+\:\s(?<ErrorMsg>[^,]+|)" has exceeded configured match_limit, consider raising the value in limits.conf

Thank you

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The quantifiers are finding too many matches.  The answer is to change the regex.  For us to help with that, however, we'll need to see sample data.

BTW, the regex command does not perform field extraction so there's no need for named capture groups in the regex.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ivana27
Path Finder

Hello, thank you for feedback.

Here is the sample data

2021-02-12 19:00:50.848 [Information] POS Transaction - Result: Ok, Card Type: Ffff, Transaction Type: AaaaBBB, Amount: 123.00, Card Technology: Ttttt, Terminal Id: 010000, Transaction Date Time: 12/02/2021 19:00:45, Acquirer Name: Dummy Data, PAN: 1111xxxxx1111, MerchantId: 123456, Extra Data: [SDD: 111#11DUMMY#11111111#1B1111#1Z1111#, CardType: DummyCompany, FuelCardBrandName: Dummy, FuelCardAliasGPM: xxxxxxxx0000, FuelCardAgesTerminalId: 111111 ], Error Message:

Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this.  It uses literal strings for each field rather than accepting anything not a comma.

Result:\s(?<Result>[^,]+), Card Type:\s(?<CardTyp>[^,]+), Transaction Type:\s(?<TxTyp>[^,]+), Amount:\s(?<Amount>[^,]+), Card Technology:\s(?<CardTech>[^,]+), Terminal Id:\s(?<TerminalId>[^,]+), Transaction Date Time:\s(?<TxDtTm>[^,]+), Acquirer Name:\s(?<AquirNm>[^,]+), PAN:\s(?<CardNu>[^,]+), MerchantId:\s(?<Merchant>[^,]+), Extra Data:\s(?<ExtraData>\[.*?\]), Error Message:\s*(?<ErrorMsg>[^,]*)
---
If this reply helps you, Karma would be appreciated.

ivana27
Path Finder

I got blanks when i have log like this 

[Error] POS Transaction - Result: Validation Rejected, Card Type: Unknown, Transaction Type: DepositPayment, Amount: 0.00 EUR, Card Technology: Unknown, Terminal Id: 11111, Transaction Date Time: , Acquirer Name: , PAN: , MerchantId: , Extra Data: , Error Message:

So,maybe proposed solution doesnt take spaces into consideration.

Can you help? Thank you

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The original regex didn't allow for optional fields (it wasn't a requirement).  Try this one.

Result:\s(?<Result>[^,]+), Card Type:\s(?<CardTyp>[^,]+), Transaction Type:\s(?<TxTyp>[^,]+), Amount:\s(?<Amount>[^,]+), Card Technology:\s(?<CardTech>[^,]+), Terminal Id:\s(?<TerminalId>[^,]+), Transaction Date Time:\s(?<TxDtTm>[^,]*), Acquirer Name:\s(?<AquirNm>[^,]*), PAN:\s(?<CardNu>[^,]*), MerchantId:\s(?<Merchant>[^,]*), Extra Data:\s(?<ExtraData>\[.*?\])*, Error Message:\s*(?<ErrorMsg>[^,]*)
---
If this reply helps you, Karma would be appreciated.
0 Karma

ivana27
Path Finder

It works, i forgot to put _raw. I will still keep post open, in case i see other bugs in mentioned log.

Thank you

0 Karma

ivana27
Path Finder

Thank you for quick respond.

Job doesnt have error anymore and its much quicker but i got null values 😞

0 Karma