Error while search query executing

[harry_123]

Any idea what this error is. I am getting the desired results with the query but it throws below error while executing

2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

• [dc3plpc0143] Streamed search execute failed because: Error in 'rex' command: regex="^(?P<Date>\w+\s+\d+)\s+(?P<Time>\d+:\d+:\d+)\s(.+\:\s){4}(?<msg>.+?)\s\[id:" has exceeded configured match_limit, consider raising the value in limits.conf.
• [dc3plpc0145] Streamed search execute failed because: Error in 'rex' command: regex="^(?P<Date>\w+\s+\d+)\s+(?P<Time>\d+:\d+:\d+)\s(.+\:\s){4}(?<msg>.+?)\s\[id:" has exceeded configured match_limit, consider raising the value in limits.conf.

[venkatasri]

Hi @harry_123 

Your rex seems simple and straight forward however the limits.conf having match_limit setting which is by default 100K. In your case the limit is exceeding it could be platform level match_limit setting could have been reduced by admin or really your rex is having too many matches ( unless you share the event this can not be confirmed. You can test same in regex101.com). Refer - limits.conf - Splunk Documentation

Have a chat with admin about of limit and check is there local setting that's getting overriding, you can use splunk btool command to verify.

-----

An upvote would be appreciated if it helps!