topic How to match two lines by a common ID within the same file and extract a field from the second line? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-match-two-lines-by-a-common-ID-within-the-same-file-and/m-p/156331#M43962 <P>How can I match 2 lines of the same file that have a random number of other lines between them?</P> <PRE><CODE>1111 Start Sub Transaction. New Id 1115 other lines here 1115 Transaction End. No Funds Available </CODE></PRE> <P>I need to match them on ID = 1115 and extract the result (in this case "No Funds Available").<BR /> Thank you.</P> Mon, 15 Jun 2015 10:29:33 GMT achetreanu 2015-06-15T10:29:33Z How to match two lines by a common ID within the same file and extract a field from the second line? https://community.splunk.com/t5/Splunk-Search/How-to-match-two-lines-by-a-common-ID-within-the-same-file-and/m-p/156331#M43962 <P>How can I match 2 lines of the same file that have a random number of other lines between them?</P> <PRE><CODE>1111 Start Sub Transaction. New Id 1115 other lines here 1115 Transaction End. No Funds Available </CODE></PRE> <P>I need to match them on ID = 1115 and extract the result (in this case "No Funds Available").<BR /> Thank you.</P> Mon, 15 Jun 2015 10:29:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-two-lines-by-a-common-ID-within-the-same-file-and/m-p/156331#M43962 achetreanu 2015-06-15T10:29:33Z Re: How to match two lines by a common ID within the same file and extract a field from the second line? https://community.splunk.com/t5/Splunk-Search/How-to-match-two-lines-by-a-common-ID-within-the-same-file-and/m-p/156332#M43963 <P>Like this:</P> <PRE><CODE>... | rex "^(?&lt;firstWord&gt;\w+).*(?&lt;lastWord&gt;\w+)$" | eval ID=if(isnumber(lastWord), lastWord, firstWord) | stats list(_raw) by ID </CODE></PRE> Mon, 15 Jun 2015 13:08:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-two-lines-by-a-common-ID-within-the-same-file-and/m-p/156332#M43963 woodcock 2015-06-15T13:08:02Z