Extract field from a new line

[ToniHuynh]

Hi all,

I would like to extract the IP of the client: from the below Message.

Message=Internal event: A client issued a search operation with the following options.

Client:

172.25.1.250:6247

Starting node: DC=abc,DC=contoso,DC=com,DC=au

Filter: ( & ( ! (uSNChanged=*) ) ( & ( | (mail=*) (proxyAddresses=*) ) ( | (objectClass=contact) (objectClass=publicFolder) (objectClass=group) (objectClass=person) (objectClass=organizationalPerson) (objectClass=user) (FALSE) ) ) )

Search scope:

subtree

Attribute selection:

sAMAccountName,mail,proxyAddresses,objectClass,uSNChanged

I can make it works on regex101 but splunk does not show anything.

| rex field=Message max_match=0 "Client:(?<Client>\n.*)"

[bowesmana · Accepted solution]

See the following - the trick is to use (?m) to span multiple lines

| makeresults
| eval Message="Internal event: A client issued a search operation with the following options.

Client:

172.25.1.250:6247

Starting node: DC=abc,DC=contoso,DC=com,DC=au

Filter: ( & ( ! (uSNChanged=*) ) ( & ( | (mail=*) (proxyAddresses=*) ) ( | (objectClass=contact) (objectClass=publicFolder) (objectClass=group) (objectClass=person) (objectClass=organizationalPerson) (objectClass=user) (FALSE) ) ) )

Search scope:

subtree

Attribute selection:

sAMAccountName,mail,proxyAddresses,objectClass,uSNChanged"
| rex field=Message max_match=0 "(?m)Client:[^\d]+(?<Client>\d+\.\d+\.\d+\.\d+)"

[ToniHuynh]

Thanks so much.