https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308980#M160244 <P>Thanks again,! but for time being, is there anyway to build regex for same?</P> Thu, 13 Jul 2017 02:22:02 GMT sumagarw 2017-07-13T02:22:02Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308975#M160239 <P>Hi All,</P> <P>I am having difficulties capturing Multiple lines of logs from splunk using rex command. </P> <P>03:25:17.296: SIPTR: Received [0,UDP] 543 bytes from 10.xx.7x.1xx:8080 &lt;&lt;&lt;&lt;&lt;<BR /> REGISTER sip:10.xx.7x.1xx SIP/2.0<BR /> Via: SIP/2.0/UDP 10.xx.7x.1xx;branch=hkhi8u09uj<BR /> From: "Dummy" ;tag=78979uh<BR /> CSeq: 68789 REGISTER<BR /> Call-ID: <A href="mailto:xxxxxx-7689-xxxx@10.xx.7x.1xx">xxxxxx-7689-xxxx@10.xx.7x.1xx</A><BR /> Contact: ;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, UPDATE, REFER"<BR /> User-Agent: Polycom_r64786r9879r87<BR /> Accept-Language: en<BR /> Max-Forwards: 70<BR /> Expires: 60</P> <P>I have to capture lines starting from "REGISTER sip:" till "User-Agent: ", is there any way to capture multiple lines in same rex file?</P> Tue, 11 Jul 2017 04:38:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308975#M160239 sumagarw 2017-07-11T04:38:22Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308976#M160240 <P>You need to use the dotall modifier to tell splunk to match newlines with '.' </P> <PRE><CODE>... | rex "REGISTER sip:(?s)(?&lt;new_field_name&gt;.*)User-Agent" </CODE></PRE> Tue, 11 Jul 2017 11:53:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308976#M160240 jplumsdaine22 2017-07-11T11:53:45Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308977#M160241 <P>Hi sumagarw,<BR /> try something like this</P> <PRE><CODE>REGISTER sip:(?&lt;your_field&gt;(.|\n)+)User-Agent: </CODE></PRE> <P>test it at <A href="https://regex101.com/r/TlOYUg/1">https://regex101.com/r/TlOYUg/1</A></P> <P>Bye.<BR /> Giuseppe</P> Tue, 11 Jul 2017 11:58:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308977#M160241 gcusello 2017-07-11T11:58:36Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308978#M160242 <P>Thanks @jplumsdaine22 <BR /> Looks like i am able to capture required lines. Can you also help me to capture "10.xx.7x.1xx SIP/2.0" , "Dummy", and "Call-ID: " from captured data in a table format. </P> <P>Thing is that data keeps on repeating, now i have to capture specified info from captured line and get in table format.</P> Tue, 11 Jul 2017 12:22:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308978#M160242 sumagarw 2017-07-11T12:22:27Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308979#M160243 <P>What you should do is create a field extraction for each field in the data. That will make your job a great deal easier! </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> Tue, 11 Jul 2017 12:43:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308979#M160243 jplumsdaine22 2017-07-11T12:43:28Z https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308980#M160244 <P>Thanks again,! but for time being, is there anyway to build regex for same?</P> Thu, 13 Jul 2017 02:22:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-capture-multiple-lines-using-rex-command/m-p/308980#M160244 sumagarw 2017-07-13T02:22:02Z