I am fairly new to regex. I wrote a regex that works fine in regex101, but because I am doing lots of back tracking I guess , Splunk rex throws below error.
has exceeded configured match_limit, consider raising the value in limits.conf
I don't have access to limits.conf file, can someone help me with regex optimization.
URL to regex: https://regex101.com/r/fUcjqi/1
regex:
(?m)^(?<exceptionName>[\w.]*Exception).*\s*(\S*\s*)?(?<endStateComponent>[\w$#.]*)\.(?<endStateFunction>[\w$#.]+\.[\w$#]+)\(\D*(?<endStateOffset>\d+)?\S*\s*\S*\s*(?:\k<endStateComponent>|((?!com.custom).)\.\S*\s*\S*\s*)*((?<firstcustomComponent>com.custom.*)\.(?<firstcustomFunction>[\w$#.]+\.[\w$#]+)\(\D*(?<firstcustomOffset>\d+)?\S*\s*\S*\s*)?(?:(\k<endStateComponent>|\k<firstcustomComponent>|((?!com.custom).)*)\.\S*\s*\S*\s*)*((?<secondcustomComponent>com.custom.*)\.(?<secondcustomFunction>[\w$#.]+\.[\w$#]+)\(\D*(?<secondcustomOffset>\d+)?)?
sample log:
Tue May 07 10:32:11 CDT 2019 SEVERE com.custom.financials.service.enterprise.server.financialinfo.PostRemittanceHandler [RequestHandler [1]] - [Error occurred when trying to post self pay remittance wrapper model][com.custom.system.enterprise.server:customdomain.custom.com][com.custom.system.enterprise.server:service:Financials][com.custom.system.enterprise.server:scp:368][com.custom.system.enterprise.server:message:PostRemittanceWrapperModel:4091003]
java.lang.NullPointerException:
at
com.custom.financials.service.enterprise.server.financialinfo.PostRemittanceHandler.handleRequest(PostRemittanceHandler.java:216)
at com.custom.financials.service.enterprise.server.FinancialsServer.handlePostRemittanceWrapperModel(FinancialsServer.java:1553)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.custom.financials.service.enterprise.server.FinancialsServer.handlePostRemittanceWrapperModel(FinancialsServer.java:1553)
at com.custom.system.enterprise.server.Server$ExecuteHandler.invoke(Server.java:422)
at com.custom.system.enterprise.server.Server.execute(Server.java:346)
at com.custom.system.enterprise.server.container.ServerContainer$EndInterceptor.intercept(ServerContainer.java:583)
at com.custom.system.enterprise.server.container.InterceptorChainImpl.execute(InterceptorChainImpl.java:53)
at com.custom.system.enterprise.server.container.ServerContainer$1.run(ServerContainer.java:386)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:360)
at com.custom.system.enterprise.server.container.ServerContainer.execute(ServerContainer.java:382)
at com.custom.system.enterprise.server.cadence.service.RRService$HandlerRunner.run(RRService.java:104)
at com.custom.system.enterprise.server.cadence.service.InstrumentedThreadPoolExecutor$InstrumentedRunnable.run(InstrumentedThreadPoolExecutor.java:210)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at com.custom.system.enterprise.server.cadence.service.ServiceManager$ContextCleaningThread.run(ServiceManager.java:373)
Your regex is causing catastrophic backtracking. You need to check it with different types of examples, and more of them.
By adding just two spaces to the example you pasted I was able to cause it to fail.
Splunk (thankfully) protects itself from catastrophic backtracking with a limit of 100K.
Can you please save your changes https://regex101.com/r/fUcjqi/1 with version where it failed