Splunk Search

getting error for regex "exceeded configured match_limit, consider raising the value in limits.conf"

vrmandadi
Builder

Below is the regex I am using

|rex field=_raw "\d*\-\d*\s\d*\:\d*\:\d*\.\d*\s(?<Primary_Server>[^\s]+)\s*(?<Primary_DB>[^\s]+)\s*(?<Secondary_Server>[^\s]+)\s*(?<Secondary_DB>[^\s]+)\s*(?<Status>[^\s]+)\s*(?<Last_Backup_File>[^\s]+)\s*(?<Backup_Threshold>[^\s]+)\s*(\d*\-\d*-\d*\s\d*\:\d*\:\d*\.\d*)\s*(?<TimeSinceLastBackup>[^\s]+)\s*(?<Last_Restored_File>[^\s]+)\s*(?<Restore_Threshold>[^\s]+)\s*(\d*\-\d*\-\d*\s\d*\:\d*\:\d*\.\d*)\s*(?<TimeSinceLastRestore>[^\s]+)\s*(?<LastRestoredLatency>[^\s]+)"

Is there a better way to write the regex or should the limits.conf be increased

Thanks in Advance

1 Solution

darrenfuller
Contributor

First off, you have lots of stars where pluses would do

Second, the pattern seems to match save the last two fields which do not exist in your example event (the data after the date after Restore_Threshold). Should those capture groups have been optional?

Third (this one is completely cosmetic and not functional) I replaced all the [^\s]+ with \S+.

^\d+-\d+-\d+\s\d+\:\d+\:\d+\.\d+\s(?<Primary_Server>\S+)\s+(?<Primary_DB>\S+)\s+(?<Secondary_Server>\S+)\s+(?<Secondary_DB>\S+)\s+(?<Status>\S+)\s+(?<Last_Backup_File>\S+)\s+(?<Backup_Threshold>\S+)\s+(\d+\-\d+-\d+\s\d+\:\d+\:\d+\.\d+)\s+(?<TimeSinceLastBackup>\S+)\s+(?<Last_Restored_File>\S+)\s+(?<Restore_Threshold>\S+)\s+(\d+\-\d+\-\d+\s\d+\:\d+\:\d+\.\d+)\s+((?<TimeSinceLastRestore>\S+)\s+(?<LastRestoredLatency>\S+))?

https://regex101.com/r/1eLLHK/2

View solution in original post

0 Karma

darrenfuller
Contributor

First off, you have lots of stars where pluses would do

Second, the pattern seems to match save the last two fields which do not exist in your example event (the data after the date after Restore_Threshold). Should those capture groups have been optional?

Third (this one is completely cosmetic and not functional) I replaced all the [^\s]+ with \S+.

^\d+-\d+-\d+\s\d+\:\d+\:\d+\.\d+\s(?<Primary_Server>\S+)\s+(?<Primary_DB>\S+)\s+(?<Secondary_Server>\S+)\s+(?<Secondary_DB>\S+)\s+(?<Status>\S+)\s+(?<Last_Backup_File>\S+)\s+(?<Backup_Threshold>\S+)\s+(\d+\-\d+-\d+\s\d+\:\d+\:\d+\.\d+)\s+(?<TimeSinceLastBackup>\S+)\s+(?<Last_Restored_File>\S+)\s+(?<Restore_Threshold>\S+)\s+(\d+\-\d+\-\d+\s\d+\:\d+\:\d+\.\d+)\s+((?<TimeSinceLastRestore>\S+)\s+(?<LastRestoredLatency>\S+))?

https://regex101.com/r/1eLLHK/2

0 Karma

vrmandadi
Builder

Thank You.It worked

0 Karma

vrmandadi
Builder

https://regex101.com/r/1eLLHK/1

sample event for example

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...