Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Field extractor is unusually slow (max single...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a regular expression that extract everything that exist between brackets
Extraction:
(?i) .*? (?P<METHOD>\-\s+\[\w+.*.\])\s+\w+
I'm receiving the following Warning
Field extractor name=EXTRACT-METHOD is unusually slow (max single event time=1081ms, probes=5 warning max=1000ms)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That regex does look a bit odd to me. If you have an event like:
blah blah [yohoo_123] blah blah
and just want to extract yohoo_123 your regex should probably look more like;
...| rex "\[(?<METHOD>[^\]]+)\]"
i.e. after the opening square bracket, grab everything that is NOT a closing square bracket, followed by a closing square bracket.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That regex does look a bit odd to me. If you have an event like:
blah blah [yohoo_123] blah blah
and just want to extract yohoo_123 your regex should probably look more like;
...| rex "\[(?<METHOD>[^\]]+)\]"
i.e. after the opening square bracket, grab everything that is NOT a closing square bracket, followed by a closing square bracket.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Should work.
props.conf
[your_sourcetype]
EXTRACT-blah = \s\[(?<METHOD>[^\]]+)\]\s
/k
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need that METHOD field will be persistent
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to put that in props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
perfect dude:)
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
