Splunk Search

How to capture multiple lines in rex

sid1808
Loves-to-Learn

HI all, 

I am trying to capture multiple lines between two strings in my log data. But so far have not been able to figure out a solution. 
the log data is as follows:

'calls': 'apfsae.providers.economic.china_jobs_data_provider.ChinaJobsProvider',

'db_connection': 'providers/database_connection :: qtrewd_iq',

'db_view_name': 'adweh.V_datayes_china_recruitment',

'calls': 'apfsae.providers.mappings.company_id_to_barra_mapper.BbToBarraMapper',

 

I want to capture lines starting from ChinaJobsProvider to 'calls': 
Thank you !

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this

| rex "(?ms)ChinaJobsProvider'(?<lines>.*)'calls"

 

0 Karma

sid1808
Loves-to-Learn

Hi I used this but it matching with every record even if it contains this data or not. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it like this so it is less greedy

| rex "(?ms)ChinaJobsProvider'(?<lines>.*?)'calls"
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...