Splunk Search

Multiline field search: How to print multiple events?

jimish
Explorer

In logs there are multiple lines printed like below  and I want to print all of them in a table but my search query only prints one value , need help to print multiple records 

Balance amount is zero for invoice id:20220402-126-12300-A

Balance amount is zero for invoice id:20220502-126-12300-B

Balance amount is zero for invoice id:20220602-126-12300-C

Need to print like : 20220704-126-77300-A, 20220404-126-77300-A , 20220704-126-77300-A

query I am trying : rex field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"

Labels (1)
Tags (2)
0 Karma
1 Solution

danielcj
Communicator

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"
| table InvoiceExceptionNo

View solution in original post

0 Karma

jimish
Explorer

thank you  max_match command did the trick.

will be very useful in future.

Thank you

0 Karma

danielcj
Communicator

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"
| table InvoiceExceptionNo
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...