How to rex multiple lines

[garujoey]

Hi there,

I am a newbie in Splunk and trying to do some search using the rex.

The log body is like:

blah blah
Dest : aaa
blah blah
Dest: bbb
blah blah
Dest: ccc

I searched online and used some command like ' rex field=_raw "(?s)Dest : (?.*)" ' or (?smi), but it wasn't what I wanted.

I need the output to only get the table like
aaa
bbb
ccc

Is there any way to do that?

Thank you very much in advance!
:)

[davey1985]

To get it into a table on its own it would be:

| rex "Dest:\s+(?<Data>.*)"
| table Data

[jimodonald]

Try this:

|  rex field=_raw "Dest\s*:\s(?P<myfield>.*)"

[woodcock · Accepted solution]

Like this:

| rex max_match=0 "(?ms)\s+Dest:\s+(?<Dest>\S+)"
| stats values(Dest) AS Dests

[davey1985]

+1 i misinterpretted. max_match=0 would get multiple results

[garujoey]

Thanks woodcock, I used "| rex max_match=0 field=_raw "(?)Dest : (?.*)" | table path" in the end, but your suggestion to use "max_match=0" really helps!

[woodcock]

That is the whole point, is it not?