Splunk Search

How to capture multiple lines in rex

sid1808
Loves-to-Learn

HI all, 

I am trying to capture multiple lines between two strings in my log data. But so far have not been able to figure out a solution. 
the log data is as follows:

'calls': 'apfsae.providers.economic.china_jobs_data_provider.ChinaJobsProvider',

'db_connection': 'providers/database_connection :: qtrewd_iq',

'db_view_name': 'adweh.V_datayes_china_recruitment',

'calls': 'apfsae.providers.mappings.company_id_to_barra_mapper.BbToBarraMapper',

 

I want to capture lines starting from ChinaJobsProvider to 'calls': 
Thank you !

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this

| rex "(?ms)ChinaJobsProvider'(?<lines>.*)'calls"

 

0 Karma

sid1808
Loves-to-Learn

Hi I used this but it matching with every record even if it contains this data or not. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this so it is less greedy

| rex "(?ms)ChinaJobsProvider'(?<lines>.*?)'calls"
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...