How to maintain format into variables

[gerardo_maya]

I want to extract part of an event that is multi-line and tab formated, the event lokks like this:

11:19:29.000 PM
7.05 0.00 (1343189969 083501): Query a ejecutar: SELECT prop_account, description
FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa'
AND home = 'es_cl'
AND portal = '*'

I want to extract from Query I use a regex and I have a variable called Message. But when I displayed it Splunk truncate the message.

1 Query a ejecutar: SELECT prop_account, description

I am using this search command:

sourcetype="xtype" query | rex field=_raw "):\s(?.+)" | table Message

Any idea could be great.

[gerardo_maya]

Professional services recommend me to do the following:
sourcetype="xtype" query | eval long_str=replace(_raw, "\n", "###") | rex field=long_str "):\s(?.+)" | makemv delim="###" Message | table _time Message

The second part of the search replaces the new lines for a know pattern (on this case ###).
Then you use REGEX to capture the field from the long_str
Using makemv you break the lines when it found the pattern "###"
Lastly you present the data into a table, this is the result.

Query a ejecutar: SELECT prop_account, description FROM tracking.google_analytics_web_properties
WHERE prop_type = 'qa' AND
home = 'es_cl' AND portal = '*'

[lguinn2]

Try

sourcetype="xtype" query | rex field=_raw "(?m)):s(?<message>.+)" | table Message

The (?m) tells the regex to work across line breaks.

[gerardo_maya]

Thank you, that works to capture all data into the variable but it does not maintain the line breaking inside the Message Variable