https://community.splunk.com/t5/Splunk-Search/How-to-use-the-DOTALL-option-in-a-regular-expression/m-p/48253#M11528 <P>I'm running a regular expression on a string which runs for 5 or more lines. The first few words on the first line helps me determine if the rest of the sentence is useful for me.</P> <PRE><CODE>rex "(?P&lt;Application&gt;\w+[a-zA-Z]*) (?P&lt;Message&gt;.*+)" | fields Application, Message | Search Application ="abc" </CODE></PRE> <P>here I want to display results if my Application equates to "abc" which is at the beginning of my multi-line string, the Message variable has only the characters till the end of the first line, it does return characters from the second or third line</P> <P>Search String</P> <P>abc def </P> <P>ghi </P> <P>jkl</P> <P>The Application variable equates "abc" and Message return only "def", but I want it to return "def ghi jkl".</P> <P>How should the Regular expression be changed to achieve this?</P> Sat, 11 Sep 2010 03:45:56 GMT tsingara 2010-09-11T03:45:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-DOTALL-option-in-a-regular-expression/m-p/48253#M11528 <P>I'm running a regular expression on a string which runs for 5 or more lines. The first few words on the first line helps me determine if the rest of the sentence is useful for me.</P> <PRE><CODE>rex "(?P&lt;Application&gt;\w+[a-zA-Z]*) (?P&lt;Message&gt;.*+)" | fields Application, Message | Search Application ="abc" </CODE></PRE> <P>here I want to display results if my Application equates to "abc" which is at the beginning of my multi-line string, the Message variable has only the characters till the end of the first line, it does return characters from the second or third line</P> <P>Search String</P> <P>abc def </P> <P>ghi </P> <P>jkl</P> <P>The Application variable equates "abc" and Message return only "def", but I want it to return "def ghi jkl".</P> <P>How should the Regular expression be changed to achieve this?</P> Sat, 11 Sep 2010 03:45:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-DOTALL-option-in-a-regular-expression/m-p/48253#M11528 tsingara 2010-09-11T03:45:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-DOTALL-option-in-a-regular-expression/m-p/48254#M11529 <P>The correct nomenclature is to add (?ms) on the beginning - the s is dotall, and the m is multi-line. Thus:</P> <PRE><CODE>rex field=_raw "(?ms)(?P&lt;Application&gt;\w+) (?P&lt;Message&gt;.*+)" </CODE></PRE> Tue, 21 Feb 2012 22:23:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-DOTALL-option-in-a-regular-expression/m-p/48254#M11529 ahall_splunk 2012-02-21T22:23:43Z