Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why won't my regular expression extract fields when the _raw field is greater than 56kb?

$
0
0
Hi, I'm trying to extract two fields with this regular expression: Transaction\sID=\"(?P\w*)\".*OperationCode=\"(?P\w*)\" and it works in almost all records but it seems that when the _raw field is greater than 56kb, the regular expression doesn't work. Any clue?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>