Splunk Search

I want to omptimize the regex? ErrorMessage : 'rex' command: has exceeded configured match_limit, consider raising the value in limits.conf.

vn_g
Path Finder
| rex field=_raw max_match=0 "BodyOftheMail_Script\s=\s\[\sBEGIN\s{0,}(?<BodyOftheMail>.((.|\n)*?)(?=\s{1,}END\s\]))"

I am trying to read body of the mail from logs ( some of the them are more than 500 lines).

I donot want to increase the value in limits.conf . Is my rex correct? Kindly help.

BodyOftheMail_Script = [ BEGIN 500 lines END ]

0 Karma

harshpatel
Contributor

Hi @vn_g,

I would suggest to try and play around with the regex at regex101.com. For the sake of example - https://regex101.com/r/7Rp8b8/1/.

You would see steps count which you can try to minimize as much as possible. I believe Splunk uses a similar metric and sets a hard limit on that for better search performance.

Thanks,
Harsh

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command requires named capture groups. Please edit the question to correct the regex.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...