How to capture multiple lines using rex command

[sumagarw]

Hi All,

I am having difficulties capturing Multiple lines of logs from splunk using rex command.

03:25:17.296: SIPTR: Received [0,UDP] 543 bytes from 10.xx.7x.1xx:8080 <<<<<
REGISTER sip:10.xx.7x.1xx SIP/2.0
Via: SIP/2.0/UDP 10.xx.7x.1xx;branch=hkhi8u09uj
From: "Dummy" ;tag=78979uh
CSeq: 68789 REGISTER
Call-ID: xxxxxx-7689-xxxx@10.xx.7x.1xx
Contact: ;methods="INVITE, ACK, BYE, CANCEL, OPTIONS, UPDATE, REFER"
User-Agent: Polycom_r64786r9879r87
Accept-Language: en
Max-Forwards: 70
Expires: 60

I have to capture lines starting from "REGISTER sip:" till "User-Agent: ", is there any way to capture multiple lines in same rex file?

[gcusello]

Hi sumagarw,
try something like this

REGISTER sip:(?<your_field>(.|\n)+)User-Agent:

test it at https://regex101.com/r/TlOYUg/1

Bye.
Giuseppe

[jplumsdaine22 · Accepted solution]

You need to use the dotall modifier to tell splunk to match newlines with '.'

... | rex "REGISTER sip:(?s)(?<new_field_name>.*)User-Agent"

[sumagarw]

Thanks @jplumsdaine22
Looks like i am able to capture required lines. Can you also help me to capture "10.xx.7x.1xx SIP/2.0" , "Dummy", and "Call-ID: " from captured data in a table format.

Thing is that data keeps on repeating, now i have to capture specified info from captured line and get in table format.

[jplumsdaine22]

What you should do is create a field extraction for each field in the data. That will make your job a great deal easier!

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

[sumagarw]

Thanks again,! but for time being, is there anyway to build regex for same?