How to create a multi-line field extraction

[dowdag]

I am using splunk free -- and have data in format of:

2019-06-06 11:10:10,029 "somedata" # - Start of event
TransId=(?\d+) # - I want to capture this value
- Logging More data on next line
PaymendId=(?\d+) #I want to capture this value -- End of event
2019-06-06 11:10:10,129 "somedata" - then next event with different logging info.

What needs to be set in the source type for this to work?

I was not able to create multi-line field exaction, I did use (?ms) but had no success.
Thanks for any help or suggestions.

[martynoconnor]

If you are happy that the event format is very consistent and doesn't change much there's nothing to stop you using [\r\n] as an option in your sourcetype EXTRACT-blah=

That would only work, however, if Splunk recognises your events are multiline (i.e. you have already included event breaking statements in props.conf and have use SHOULD_LINEMERGE=true.

This works:

TransId=(?\d+)\s.+[\r\n]+.+[\r\n]PaymentId=(?\d+)\s