Splunk Search

Optimize Regex

secphilomath1
Explorer

I am getting an error when using the following regex

(?<=on\s)(.*)(?=\sby Firewall Settings)

The error is "Error in 'rex' command: regex="(?<=on\s)(.*)(?<HostName>.*)(?=\sby Firewall Settings)" has exceeded configured match_limit, consider raising the value in limits.conf."

Is there a better way to do this,  I am trying to find all text between "on " and " by Firewall Settings.  It works in regex101.com, but I get that error in Splunk.

 

TIA!

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It would help to have a sample (sanitized) event to work with.

Avoid lookbehind and lookahead in Splunk.  They're costly and rarely necessary.  Try

on\s(?<HostName>\S*)\sby Firewall Settings
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

secphilomath1
Explorer

Good to know, thanks, works perfectly.

 

richgalloway
SplunkTrust
SplunkTrust

It would help to have a sample (sanitized) event to work with.

Avoid lookbehind and lookahead in Splunk.  They're costly and rarely necessary.  Try

on\s(?<HostName>\S*)\sby Firewall Settings
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...