How to build rex for field extraction in one event?

[kc_prane]

Hello,  Can someone  Please help to build rex for field extraction in one event. Currently iam using the below basic rex but its pulling only first line in the results. i need all the results so i can table them.

|rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)"

[kc_prane]

Thanks @isoutamo

[isoutamo · Accepted solution]

Hi

see max_match on https://docs.splunk.com/Documentation/Splunk/9.0.0/SearchReference/Rex

r. Ismo