Splunk Search

On the limit of delimiter in field extracter

yutaka1005
Builder

I indexed some logs that have values are separated by commas, and I attempted to extract fields using delimiter, but the following error was output.

regular expression is too large

Does the delimiter extraction have limit values?
I hope someone can tell me.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try shortening all the field names in the regex

Ex:

 (?<my_long_field_name>regextoextract)

Becomes

 (?<a>regextoextract)

Do that for all your field names, then rename them in search. I believe you’re hitting a validation character limit of 8096.

0 Karma

yutaka1005
Builder

Thank youf for answer!

8096 means 8096 bytes?
And is it limit of splunk regex?

0 Karma

p_gurav
Champion

Can you give sample data? How many columns you are extracting?
Try extracting with transforms.conf, refer below doc:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configureadvancedextractionswithfieldtra...

0 Karma

yutaka1005
Builder

Thank you for comment.

I'm sorry, I can't give you sample data,but It has over 200 columns.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...