Hey @ITWhisperer , You are absolutely right, just have edited the rex . I am not using max_match. This error appears once there are a lots of matching events. On the other hand rex with less step...
See more...
Hey @ITWhisperer , You are absolutely right, just have edited the rex . I am not using max_match. This error appears once there are a lots of matching events. On the other hand rex with less steps and one property (exclude EXCID) less achieves to retrieve all events and no error thrown.
| rex "#HLS#\s*IID:\s*(?P<IID>[^,]+),\s*STEP:\s*(?P<STEP>[^,]+),\s*PKEY:\s*(?P<PKEY>.*?),\s*STATE:\s*(?P<STATE>[^,]+),\s*MSG0:\s*(?P<MSG0>.*?),\s*PROPS:\s*(?P<PROPS>[^#]+)\s*#HLE#"
Thanks! BR, Ivo