Splunk Search

Field extractor is unusually slow (max single event time=, probes=warning max=)

Builder

I have a regular expression that extract everything that exist between brackets
Extraction:

(?i) .*?   (?P<METHOD>\-\s+\[\w+.*.\])\s+\w+

I'm receiving the following Warning
Field extractor name=EXTRACT-METHOD is unusually slow (max single event time=1081ms, probes=5 warning max=1000ms)

0 Karma
1 Solution

Ultra Champion

That regex does look a bit odd to me. If you have an event like:

blah blah [yohoo_123] blah blah

and just want to extract yohoo_123 your regex should probably look more like;

...| rex "\[(?<METHOD>[^\]]+)\]"

i.e. after the opening square bracket, grab everything that is NOT a closing square bracket, followed by a closing square bracket.

/K

View solution in original post

Ultra Champion

That regex does look a bit odd to me. If you have an event like:

blah blah [yohoo_123] blah blah

and just want to extract yohoo_123 your regex should probably look more like;

...| rex "\[(?<METHOD>[^\]]+)\]"

i.e. after the opening square bracket, grab everything that is NOT a closing square bracket, followed by a closing square bracket.

/K

View solution in original post

Ultra Champion

Should work.

props.conf
[your_sourcetype]
EXTRACT-blah = \s\[(?<METHOD>[^\]]+)\]\s

/k

0 Karma

Builder

I need that METHOD field will be persistent

0 Karma

Builder

How to put that in props.conf

0 Karma

Builder

perfect dude:)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!