Splunk Search
Highlighted

How to create a multi-line field extraction

Engager

I am using splunk free -- and have data in format of:

2019-06-06 11:10:10,029 "somedata" # - Start of event
TransId=(?\d+) # - I want to capture this value
- Logging More data on next line
PaymendId=(?\d+) #I want to capture this value -- End of event
2019-06-06 11:10:10,129 "somedata" - then next event with different logging info.

What needs to be set in the source type for this to work?

I was not able to create multi-line field exaction, I did use (?ms) but had no success.
Thanks for any help or suggestions.

0 Karma
Highlighted

Re: How to create a multi-line field extraction

Communicator

If you are happy that the event format is very consistent and doesn't change much there's nothing to stop you using [\r\n] as an option in your sourcetype EXTRACT-blah=

That would only work, however, if Splunk recognises your events are multiline (i.e. you have already included event breaking statements in props.conf and have use SHOULD_LINEMERGE=true.

This works:

TransId=(?\d+)\s.+[\r\n]+.+[\r\n]PaymentId=(?\d+)\s

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.