Splunk Search

How to create a multi-line field extraction

dowdag
Engager

I am using splunk free -- and have data in format of:

2019-06-06 11:10:10,029 "somedata" # - Start of event
TransId=(?\d+) # - I want to capture this value
- Logging More data on next line
PaymendId=(?\d+) #I want to capture this value -- End of event
2019-06-06 11:10:10,129 "somedata" - then next event with different logging info.

What needs to be set in the source type for this to work?

I was not able to create multi-line field exaction, I did use (?ms) but had no success.
Thanks for any help or suggestions.

0 Karma

martynoconnor
Communicator

If you are happy that the event format is very consistent and doesn't change much there's nothing to stop you using [\r\n] as an option in your sourcetype EXTRACT-blah=

That would only work, however, if Splunk recognises your events are multiline (i.e. you have already included event breaking statements in props.conf and have use SHOULD_LINEMERGE=true.

This works:

TransId=(?\d+)\s.+[\r\n]+.+[\r\n]PaymentId=(?\d+)\s

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...