Optimize Regex

[secphilomath1]

I am getting an error when using the following regex

(?<=on\s)(.*)(?=\sby Firewall Settings)

The error is "Error in 'rex' command: regex="(?<=on\s)(.*)(?<HostName>.*)(?=\sby Firewall Settings)" has exceeded configured match_limit, consider raising the value in limits.conf."

Is there a better way to do this,  I am trying to find all text between "on " and " by Firewall Settings.  It works in regex101.com, but I get that error in Splunk.

TIA!

[secphilomath1]

Good to know, thanks, works perfectly.

[richgalloway · Accepted solution]

It would help to have a sample (sanitized) event to work with.

Avoid lookbehind and lookahead in Splunk.  They're costly and rarely necessary.  Try

on\s(?<HostName>\S*)\sby Firewall Settings