regex returns limit exceeded

[drissbek]

Hi

Could you please help me figure out what is wrong with my regex. Splunk is returning a limite exceeds error while my regex is correct according to regex101.

PI, my log looks like below :

XXXX|YYYYY|ZZZZZ|UUUUUU

my regex is:

(?P<XXX>[\,+])\|(?P<YYY>[\,+])\|(?P<ZZZ>[\,+])\|(?P<UUU>[\,+])

[koshyk]

seems your regex had small issue

| makeresults
| eval msg="XXXX|YYYYY|ZZZZZ|UUUUUU"
| rex field=msg "(?P<XXX>[^\|]+)\|(?P<YYY>[^\|]+)\|(?P<ZZZ>[^\|]+)\|(?P<UUU>[^\|]+)"

[isoutamo]

Maybe it’s better to use extract if/when you have |-delimiter events?

https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Extract

r. Ismo