https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284662#M86094 <PRE><CODE>S,login.test.com,HTTPS,,2016-07-27T06:41:43.000Z,,iPad,0,,login.test.com,,1469601703,NA,PROD-150607-to-as-edgenode-3,N,"{""cpu"":""NA"",""cpu_bus"":"""",""toolbar"":""""}",,mobile,0,,1.1,,"Host: login.test.com User-Agent: Mozilla/5.0 (iPad; CPU OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F69 Safari/i-filter/ios Content-Type: application/x-www-form-urlencoded Referer: <A href="https://login.test.com/auwallet/action/ss111A/W111A" target="test_blank">https://login.test.com/auwallet/action/ss111A/W111A</A> 11Action/RW111A1156 Via: 1.1 h0-s234.p34-kix.cdngp.net apach/8.1.38, 1.1 h0-s112.p21-nrt.cdngp.net apache/8.1.38 X-Forwarded-For: 106.0.11.7, 14.0.41.130, 14.0.35.143 X-Forwarded-IP: 106.0.11.7 X-Initial-Url: <A href="https://login.test.com/auwallet/action/ss111A/W111A11Action/RW111A1141" target="test_blank">https://login.test.com/auwallet/action/ss111A/W111A11Action/RW111A1141</A> X-SESSION-ID: Mjk4MzoxNDY5NjAxNzAyOTk3OjEwNzM0 X-User-IP-Port: 106.186.201.7:62923 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Accept-Language: ja-jp Origin: <A href="https://login.test.com" target="test_blank">https://login.test.com</A> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Content-Length: 490 X-Forwarded-Proto: https X-FB-SSL: on ",N,/var/log/edgenode/edgenode_v10.log,NA,IPS,POST,200,106.186.201.7,,orange NW,NA,c75139c390c894d7da51d3761215b494,,120064994,test CORPORATION,NA,,,1,d118d507dc7e731d2b986967882b7914-4-0-0-0,NA,,,,,/auwallet/action/ss111A/W111A11Action/RW111A1141,be6f66140b11d6af114106c1f5b93786,text/html,AppleWebKit,monitor,JP,allow,0,275190, </CODE></PRE> <P>I want to extract <STRONG>User-Agent</STRONG> <BR /> How to do I do?</P> Wed, 27 Jul 2016 09:39:11 GMT dongeui_hong 2016-07-27T09:39:11Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284662#M86094 <PRE><CODE>S,login.test.com,HTTPS,,2016-07-27T06:41:43.000Z,,iPad,0,,login.test.com,,1469601703,NA,PROD-150607-to-as-edgenode-3,N,"{""cpu"":""NA"",""cpu_bus"":"""",""toolbar"":""""}",,mobile,0,,1.1,,"Host: login.test.com User-Agent: Mozilla/5.0 (iPad; CPU OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F69 Safari/i-filter/ios Content-Type: application/x-www-form-urlencoded Referer: <A href="https://login.test.com/auwallet/action/ss111A/W111A" target="test_blank">https://login.test.com/auwallet/action/ss111A/W111A</A> 11Action/RW111A1156 Via: 1.1 h0-s234.p34-kix.cdngp.net apach/8.1.38, 1.1 h0-s112.p21-nrt.cdngp.net apache/8.1.38 X-Forwarded-For: 106.0.11.7, 14.0.41.130, 14.0.35.143 X-Forwarded-IP: 106.0.11.7 X-Initial-Url: <A href="https://login.test.com/auwallet/action/ss111A/W111A11Action/RW111A1141" target="test_blank">https://login.test.com/auwallet/action/ss111A/W111A11Action/RW111A1141</A> X-SESSION-ID: Mjk4MzoxNDY5NjAxNzAyOTk3OjEwNzM0 X-User-IP-Port: 106.186.201.7:62923 Accept-Encoding: gzip, deflate Proxy-Connection: keep-alive Accept-Language: ja-jp Origin: <A href="https://login.test.com" target="test_blank">https://login.test.com</A> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Content-Length: 490 X-Forwarded-Proto: https X-FB-SSL: on ",N,/var/log/edgenode/edgenode_v10.log,NA,IPS,POST,200,106.186.201.7,,orange NW,NA,c75139c390c894d7da51d3761215b494,,120064994,test CORPORATION,NA,,,1,d118d507dc7e731d2b986967882b7914-4-0-0-0,NA,,,,,/auwallet/action/ss111A/W111A11Action/RW111A1141,be6f66140b11d6af114106c1f5b93786,text/html,AppleWebKit,monitor,JP,allow,0,275190, </CODE></PRE> <P>I want to extract <STRONG>User-Agent</STRONG> <BR /> How to do I do?</P> Wed, 27 Jul 2016 09:39:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284662#M86094 dongeui_hong 2016-07-27T09:39:11Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284663#M86095 <P>If you want to extract in SPL or IFX, use this regex</P> <PRE><CODE>... | rex "User-Agent:(?&lt;UA&gt;[^\t\n\r]+)" </CODE></PRE> Wed, 27 Jul 2016 12:23:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284663#M86095 sundareshr 2016-07-27T12:23:18Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284664#M86096 <P>Thanks ~~~ <BR /> solved.</P> Thu, 28 Jul 2016 01:03:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-multiline-quot-User-Agent-quot-field-from-my/m-p/284664#M86096 dongeui_hong 2016-07-28T01:03:50Z