https://community.splunk.com/t5/Splunk-Search/How-to-search-over-multiple-lines/m-p/486363#M136064 <P>Hello together,</P> <P>I want to search for "Binding Type: 0" in the following example log:</P> <P><STRONG>LogName=Directory Service<BR /> SourceName=Microsoft-Windows-ActiveDirectory_DomainService<BR /> EventCode=2889<BR /> EventType=4<BR /> Type=Information<BR /> ComputerName=XXXXX<BR /> User=NOT_TRANSLATED<BR /> Sid=S-1-5-7<BR /> SidType=0<BR /> TaskCategory=LDAP Interface<BR /> OpCode=The operation completed successfully.<BR /> RecordNumber=7362133<BR /> Keywords=Classic<BR /> Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection. <BR /> Client IP address:<BR /> 1.1.11.1:5555 <BR /> Identity the client attempted to authenticate as:<BR /> XXX\XXXX<BR /> Binding Type:<BR /> 0</STRONG></P> <P>The problem is that the value 0 is a new line. <BR /> Do you know how can I search for this?</P> <P>Please help.</P> Wed, 30 Sep 2020 02:16:07 GMT ahmet_goekduman 2020-09-30T02:16:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-over-multiple-lines/m-p/486363#M136064 <P>Hello together,</P> <P>I want to search for "Binding Type: 0" in the following example log:</P> <P><STRONG>LogName=Directory Service<BR /> SourceName=Microsoft-Windows-ActiveDirectory_DomainService<BR /> EventCode=2889<BR /> EventType=4<BR /> Type=Information<BR /> ComputerName=XXXXX<BR /> User=NOT_TRANSLATED<BR /> Sid=S-1-5-7<BR /> SidType=0<BR /> TaskCategory=LDAP Interface<BR /> OpCode=The operation completed successfully.<BR /> RecordNumber=7362133<BR /> Keywords=Classic<BR /> Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection. <BR /> Client IP address:<BR /> 1.1.11.1:5555 <BR /> Identity the client attempted to authenticate as:<BR /> XXX\XXXX<BR /> Binding Type:<BR /> 0</STRONG></P> <P>The problem is that the value 0 is a new line. <BR /> Do you know how can I search for this?</P> <P>Please help.</P> Wed, 30 Sep 2020 02:16:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-over-multiple-lines/m-p/486363#M136064 ahmet_goekduman 2020-09-30T02:16:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-over-multiple-lines/m-p/486364#M136065 <P>Hi<BR /> you can use the regex command, something like this:</P> <PRE><CODE>your_search | regex "(?ms)Binding\s+Type:\s+0" | ... </CODE></PRE> <P>You can test the regex at <A href="https://regex101.com/r/B7f8Yz/1">https://regex101.com/r/B7f8Yz/1</A> .</P> <P>Bye.<BR /> Giuseppe</P> Thu, 26 Sep 2019 15:16:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-over-multiple-lines/m-p/486364#M136065 gcusello 2019-09-26T15:16:01Z