Splunk Search

Optimize rex command

Path Finder

Hi all,

I want to extract fields form log events.

I have two errors patterns :

* Can not convert FOO from here ==> *
Can't find the FOO segment

What i want is to create a field named grammar_error_reason that contain "Can not convert FOO" or "Can't find the FOO segment"

Here is my rex command :

| rex field=CDREASON "Converted segments:(\s\w{3}+\s-)+\s(?<grammar_error_reason>.+) from here"

This command raise le limits of limits.conf. It take 236 steps.
In the limits.conf file the rex limits are :

match_limit = 100000
depth_limit = 1000

Can you help me please.

Kind regards,

0 Karma

Esteemed Legend

Your problem has nothing to do with limits; your problem is that your RegEx is wrong. Try this:

... | rex field=CDREASON "(?<grammar_error_reason>(?:Can not convert|Can't find the)\s+\w+)\s+(?:from here|segment)"
0 Karma

Ultra Champion
| makeresults 
| eval CDREASON=" * Can not convert FOO from here ==> *
 Can't find the FOO segment"
| rex field=CDREASON max_match=100 "(Can not convert|Can't find the) (?<grammar_error_reason>\w+) (from here|segment)"

HI, @clementros
How many lines per event?
If there are more than 100 lines, increase max_match values.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...