Splunk Search

field Extraction

christian75
Engager
When i want to extract BiosMake fields with fields extraction.I have this error:
Error in 'rex' command
Labels (1)
0 Karma
1 Solution

aasabatini
Builder

Hi @christian75 

please share a set of data and your rex expression because with less information we can't help

Regards

Ale

View solution in original post

0 Karma

christian75
Engager

Thanks I have my answer 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @christian75,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

christian75
Engager

Thanks I have my answer 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @christian75,

at first what's your error? "Rex has exceeded configured match_limit"?

You are receiving this error becuase your regular expression takes a lot of steps to try and match your events.

Sharing your regex and a sample of your logs we'd help you.

Ciao.

Giuseppe

0 Karma

aasabatini
Builder

Hi @christian75 

please share a set of data and your rex expression because with less information we can't help

Regards

Ale

View solution in original post

0 Karma