I indexed some logs that have values are separated by commas, and I attempted to extract fields using
delimiter, but the following error was output.
regular expression is too large
delimiter extraction have limit values?
I hope someone can tell me.
Can you give sample data? How many columns you are extracting?
Try extracting with transforms.conf, refer below doc:
Try shortening all the field names in the regex
Do that for all your field names, then rename them in search. I believe you’re hitting a validation character limit of 8096.