Splunk Search

field Extraction

christian75
Engager
When i want to extract BiosMake fields with fields extraction.I have this error:
Error in 'rex' command
Labels (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @christian75 

please share a set of data and your rex expression because with less information we can't help

Regards

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

0 Karma

christian75
Engager

Thanks I have my answer 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @christian75,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

christian75
Engager

Thanks I have my answer 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @christian75,

at first what's your error? "Rex has exceeded configured match_limit"?

You are receiving this error becuase your regular expression takes a lot of steps to try and match your events.

Sharing your regex and a sample of your logs we'd help you.

Ciao.

Giuseppe

0 Karma

aasabatini
Motivator

Hi @christian75 

please share a set of data and your rex expression because with less information we can't help

Regards

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...