Multi line field Extraction

[michaeloleary]

Hi,

I'm having problem with a multi-line field extraction which I have been struggling to figure out. Im wondering if I could get some help with this. Essentially I'm trying to extract everything from the ">>>" through to "ERR" (non-inclusive) for the field, the field can range to multiple lines anything from 1 up to 25. I'd be very grateful if someone could help me out here, or even point me in the right direction.

/>>>
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
ERR

[Ayn · Accepted solution]

You need to use the regex modifier s so that dots match newlines, and possibly also the m modifier so that carets and dollars math before and after newlines (though I don't use m in the example below because it doesn't make use of carets and dollars).

... | rex "(?s)/>>>(?<myfield>.+?)ERR"

More information on regex modifiers: http://www.regular-expressions.info/modifiers.html

[michaeloleary]

Excuse the delay in getting back to you in a timely fashion, that works perfectly. I knew I had to use either Multi-line or Single line options but I couldn't get the syntax quite right. Thanks for your help.