Splunk Search

I want to omptimize the regex? ErrorMessage : 'rex' command: has exceeded configured match_limit, consider raising the value in limits.conf.

Path Finder
| rex field=_raw max_match=0 "BodyOftheMail_Script\s=\s\[\sBEGIN\s{0,}(?<BodyOftheMail>.((.|\n)*?)(?=\s{1,}END\s\]))"

I am trying to read body of the mail from logs ( some of the them are more than 500 lines).

I donot want to increase the value in limits.conf . Is my rex correct? Kindly help.

BodyOftheMail_Script = [ BEGIN 500 lines END ]

0 Karma


Hi @vn_g,

I would suggest to try and play around with the regex at regex101.com. For the sake of example - https://regex101.com/r/7Rp8b8/1/.

You would see steps count which you can try to minimize as much as possible. I believe Splunk uses a similar metric and sets a hard limit on that for better search performance.


0 Karma


The rex command requires named capture groups. Please edit the question to correct the regex.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!