How can SEDCMD be used to extract and modify KV pairs from multiline events?

[crisjnelson]

Here is a sample event I am attempting to parse and substitute 'SomeData=.*Transaction Type : ' with 'TxnType='

DT=2018-01-23T14:29:56.456-0800 | AppId=R4 |AppInst=SIMULATOR:201801231429 |LogId=TxLog |TxCode=Zoom | Level=INFO |SomeData=[UID:xxxxxxxxxxxx:SIMULATOR:2018012314, Message Timestamp:2018-01-23 14:29:55.976] [Zoom Result Code : ]
[Fun : 00]
[Transaction Identifier : 987xxxxxxxxxxxxx]
[Transaction Type : 00]
[More Fun : 00]

I have made various attempts. Here is my latest...

SEDCMD-all = s/SomeData=[.\r\n]+Transaction\sType\s:\s/TxnType=/g

[harsmarvania57]

Hi,

Can you please try this?

SEDCMD-all = s/(?s)SomeData=.*\[Transaction\sType\s\:/TxnType=/g

[crisjnelson]

Excellent! Much appreciated.... I had tried the flags prior, but another portion of the expression must not have been correct. Thanks!