Splunk Search

how to extract this fields


When i try to extract BiosMake fields in my log file with field extraction (Mode regex).I have this:Error in 'rex' command: regex="^\w+="\d+\.\d+\.\d+\.\d+"\s+\w+=\w+\d+\s+\w+=\d+\s+\w+=\w+\-\w+\s+\d+\-\w+\s+\w+=\d+\.\d+\s+\w+=\w+\d+\s+\w+\.\s+\d+\.\d+\.\d+\s+\w+=\d+\s+\w+=\d+\w+\d+\s+\d+:\d+:\d+\.\d+\s+\w+=\w+\.\w+\.\w+\\\w+\-\w+\-\w+\d+\w+\s+\w+=\w+\d+\s+\w+\s+\d+\s+\w+\s+\w+=\w+\s+\w+\s+\w+=\w+\d+\s+\w+=(?P<volumeEncryptionState>\w+)" has exceeded configured match_limit, consider raising the value in limits.conf

this is my log:


AgentVersion="2.5.1126.0" ComputerManufacturerName=ASDA3101705 iscompliant=1 policyCipherStrength=AES-CBC 128-Bit TpmVersion=1.4 BiosVersion=N75 Ver. 01.33 Id=292629 LatestEntry=2021May14 14:31:36.077 MachinesUsersNames=eu.airbus.corp\TA-ADMIN-ST40783 OperatingSystemName=ASDA3101705 Windows 10 Enterprise ComputerType=Portable Name=ASDA3101705 volumeEncryptionState=Encrypting TpmMake=IFX  BiosMake=Phoenix Technologies LTD
Labels (1)
0 Karma

Esteemed Legend

Hi @christian75,

if your volumeEncryptionState field hasn't any space in the value, please try this regex

| rex "volumeEncryptionState\=(?<volumeEncryptionState>[^ ]+)"

that you can test at https://regex101.com/r/nejG4v/1

otherwise, please test this:

| rex "volumeEncryptionState\=(?<volumeEncryptionState>.+)\s+TpmMake"

 that you can test at https://regex101.com/r/nejG4v/2



0 Karma


Do you not need to escape the embedded double quotes?

0 Karma


Hi @christian75 

I suppose your regex is to heavy and generate and error anyway I suggest to use automatic key value extraction


however if you need a new light regex you can use this:



BiosMake=(?<biosmake>[^ ].+)


 hope can help


“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...