Splunk Search

Multiline field search: How to print multiple events?

jimish
Explorer

In logs there are multiple lines printed like below  and I want to print all of them in a table but my search query only prints one value , need help to print multiple records 

Balance amount is zero for invoice id:20220402-126-12300-A

Balance amount is zero for invoice id:20220502-126-12300-B

Balance amount is zero for invoice id:20220602-126-12300-C

Need to print like : 20220704-126-77300-A, 20220404-126-77300-A , 20220704-126-77300-A

query I am trying : rex field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"

Labels (1)
Tags (2)
0 Karma
1 Solution

danielcj
Communicator

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"
| table InvoiceExceptionNo

View solution in original post

0 Karma

jimish
Explorer

thank you  max_match command did the trick.

will be very useful in future.

Thank you

0 Karma

danielcj
Communicator

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"
| table InvoiceExceptionNo
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...