Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Rex has exceeded configured match_limit, consider raising the value in limits.conf

$
0
0
I am trying to extract about 20 fields from a log file each lines have about 800 charachers, I can only extract to first 14 field the get error saying my rex has exceeded configured match_limit, consider raising the value in limits.conf. First, base on documentation the default value for match_limit is 100000. I am no where to close that limit,(I think) Second I did try to check the configure file. but it doesnt seems working. I created a limits.conf file in ....\etc\system\local\limits.conf. doesnt work I changed ...\etc\system\default\limits.conf. doesnt work. Any suggestion of where I am doing wrong? Is that possible is my rex(as below) not right? ^(.*?)"(?.+?(?="))(.*?){(?.+?(?=}))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)(?.+?(?=<))(.+?)"(?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>