topic Re: Multiline field search: How to print multiple events? in Splunk Search

Multiline field search: How to print multiple events?

jimish — Fri, 08 Jul 2022 16:18:31 GMT

In logs there are multiple lines printed like below and I want to print all of them in a table but my search query only prints one value , need help to print multiple records

Balance amount is zero for invoice id:20220402-126-12300-A

Balance amount is zero for invoice id:20220502-126-12300-B

Balance amount is zero for invoice id:20220602-126-12300-C

Need to print like : 20220704-126-77300-A, 20220404-126-77300-A , 20220704-126-77300-A

query I am trying : rex field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"

Re: Multiline field search: How to print multiple events?

danielcj — Fri, 08 Jul 2022 17:15:41 GMT

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)" | table InvoiceExceptionNo

Re: Multiline field search: How to print multiple events?

jimish — Fri, 08 Jul 2022 17:24:00 GMT

thank you max_match command did the trick.

will be very useful in future.

Thank you