Extracting field below variable

[aaronkorn]

Hello, we are looking at errpt messages and are having difficulty extracting certain fields from the text below:

Everything with a ":" was easy to extract the value but we are having problems extracting the field below Description, which would be REPAIR ACTION in the first example. Any idea how to extract this file or a regex that would accomplish this?

Date/Time: Mon Jan 14 10:23:35 EST 2013
Sequence Number: 4287
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: H
Type: INFO
WPAR: Global
Resource Name: fscsi2

Resource Class:

Resource Type:

Location:

Description
REPAIR ACTION
User Causes
PARTS REPLACEMENT

Date/Time: Wed Jan 9 17:49:04 EST 2013
Sequence Number: 4283
Machine Id: 00F6BEB14C00
Node Id: h1dev16
Class: O
Type: INFO
WPAR: Global
Resource Name: hdisk57

Description
PATH HAS RECOVERED
Probable Causes
ADAPTER HARDWARE OR CABLE
DASD DEVICE
Failure Causes
EF00

[jkat54]

Assuming thats a line break:

rex field="yourfield" "(?<desc>(?<=Description\r)(.*))" | table desc

http://gskinner.com/RegExr/ is a great tool for these scenarios

[aaronkorn]

This does not seem to work for us. If we were to copy that regex into the field extraction tool it cant seem to match (?(?<=Description\r)(.*))

[jkat54]

Since you didnt mention you would put this in the field extractor I told you how to do it with the rex command.,

To do it in field extractor, you could change it to (?<=Description\r)(.*)