https://community.splunk.com/t5/Splunk-Search/regex-global-modifiers/m-p/257405#M77087 <P>Hi,</P> <P>I trying to execute regex in search command with g (global) m (multi-line) s (single-line).<BR /> the regular way (?<STRONG>gms</STRONG>) yields g is unknown flag, so I've tried to convert it to sed mode s/(?<STRONG>ms</STRONG>).../replace/<STRONG>g</STRONG>.<BR /> Am I missing something?<BR /> Is there another way to achieve it?</P> Wed, 23 Mar 2016 09:10:38 GMT alon7786 2016-03-23T09:10:38Z https://community.splunk.com/t5/Splunk-Search/regex-global-modifiers/m-p/257405#M77087 <P>Hi,</P> <P>I trying to execute regex in search command with g (global) m (multi-line) s (single-line).<BR /> the regular way (?<STRONG>gms</STRONG>) yields g is unknown flag, so I've tried to convert it to sed mode s/(?<STRONG>ms</STRONG>).../replace/<STRONG>g</STRONG>.<BR /> Am I missing something?<BR /> Is there another way to achieve it?</P> Wed, 23 Mar 2016 09:10:38 GMT https://community.splunk.com/t5/Splunk-Search/regex-global-modifiers/m-p/257405#M77087 alon7786 2016-03-23T09:10:38Z https://community.splunk.com/t5/Splunk-Search/regex-global-modifiers/m-p/257406#M77088 <P>Instead of the <STRONG>g</STRONG> modifier, use the <CODE>max_match</CODE> option. For example:</P> <PRE><CODE>... | rex max_match=0 "(?ms)(foo)" | ... </CODE></PRE> <P>will find all instances of 'foo' in _raw.</P> <P>That said, replacing rex with sed does something very different. What exactly are you trying to accomplish with rex?</P> Wed, 23 Mar 2016 15:23:08 GMT https://community.splunk.com/t5/Splunk-Search/regex-global-modifiers/m-p/257406#M77088 richgalloway 2016-03-23T15:23:08Z