Splunk Search

How to rex multiple lines

garujoey
Engager

Hi there,

I am a newbie in Splunk and trying to do some search using the rex.

The log body is like:

blah blah
Dest : aaa
blah blah
Dest: bbb
blah blah
Dest: ccc

I searched online and used some command like ' rex field=_raw "(?s)Dest : (?.*)" ' or (?smi), but it wasn't what I wanted.

I need the output to only get the table like
aaa
bbb
ccc

Is there any way to do that?

Thank you very much in advance!
:)

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| rex max_match=0 "(?ms)\s+Dest:\s+(?<Dest>\S+)"
| stats values(Dest) AS Dests

View solution in original post

davey1985
Explorer

To get it into a table on its own it would be:

| rex "Dest:\s+(?<Data>.*)"
| table Data
0 Karma

jimodonald
Contributor

Try this:

|  rex field=_raw "Dest\s*:\s(?P<myfield>.*)"
0 Karma

woodcock
Esteemed Legend

Like this:

| rex max_match=0 "(?ms)\s+Dest:\s+(?<Dest>\S+)"
| stats values(Dest) AS Dests

davey1985
Explorer

+1 i misinterpretted. max_match=0 would get multiple results

0 Karma

garujoey
Engager

Thanks woodcock, I used "| rex max_match=0 field=_raw "(?)Dest : (?.*)" | table path" in the end, but your suggestion to use "max_match=0" really helps!

0 Karma

woodcock
Esteemed Legend

That is the whole point, is it not?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...