https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248808#M189210 <PRE><CODE>"call_before_download = function(){" AND "showInstallInstructions(); }" </CODE></PRE> Tue, 28 Aug 2018 15:00:30 GMT jkat54 2018-08-28T15:00:30Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248806#M189208 <P>I want to search a string<BR /><BR /> "call_before_download = function(){<BR /> showInstallInstructions(); }</P> Tue, 29 Sep 2020 09:41:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248806#M189208 Bhagyashri 2020-09-29T09:41:50Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248807#M189209 <P>Something like this should work</P> <PRE><CODE>...| regex _raw="call_before[\s\S]+showInstallInstructions\(\); }" </CODE></PRE> <P>If you have this extracted in a field, you should replace <CODE>_raw</CODE> with fieldname</P> Sat, 14 May 2016 13:06:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248807#M189209 sundareshr 2016-05-14T13:06:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248808#M189210 <PRE><CODE>"call_before_download = function(){" AND "showInstallInstructions(); }" </CODE></PRE> Tue, 28 Aug 2018 15:00:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-a-string-having-multiple-lines/m-p/248808#M189210 jkat54 2018-08-28T15:00:30Z