Splunk Search

Multi line field Extraction

michaeloleary
Path Finder

Hi,

I'm having problem with a multi-line field extraction which I have been struggling to figure out. Im wondering if I could get some help with this. Essentially I'm trying to extract everything from the ">>>" through to "ERR" (non-inclusive) for the field, the field can range to multiple lines anything from 1 up to 25. I'd be very grateful if someone could help me out here, or even point me in the right direction.

/>>>
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
1 25MAY10 test1 test2 00.00 00000.00
ERR

1 Solution

Ayn
Legend

You need to use the regex modifier s so that dots match newlines, and possibly also the m modifier so that carets and dollars math before and after newlines (though I don't use m in the example below because it doesn't make use of carets and dollars).

... | rex "(?s)/>>>(?<myfield>.+?)ERR"

More information on regex modifiers: http://www.regular-expressions.info/modifiers.html

View solution in original post

Ayn
Legend

You need to use the regex modifier s so that dots match newlines, and possibly also the m modifier so that carets and dollars math before and after newlines (though I don't use m in the example below because it doesn't make use of carets and dollars).

... | rex "(?s)/>>>(?<myfield>.+?)ERR"

More information on regex modifiers: http://www.regular-expressions.info/modifiers.html

michaeloleary
Path Finder

Excuse the delay in getting back to you in a timely fashion, that works perfectly. I knew I had to use either Multi-line or Single line options but I couldn't get the syntax quite right. Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...