Multiline field search: How to print multiple events?

[jimish]

In logs there are multiple lines printed like below  and I want to print all of them in a table but my search query only prints one value , need help to print multiple records 

Balance amount is zero for invoice id:20220402-126-12300-A

Balance amount is zero for invoice id:20220502-126-12300-B

Balance amount is zero for invoice id:20220602-126-12300-C

Need to print like : 20220704-126-77300-A, 20220404-126-77300-A , 20220704-126-77300-A

query I am trying : rex field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"

[jimish]

thank you  max_match command did the trick.

will be very useful in future.

Thank you

[danielcj · Accepted solution]

Hello @jimish ,

Please try using the "max_match" command on the rex definition. Like this one:

| rex max_match=0 field=_raw "Balance amount is zero for invoice id:(?P<InvoiceExceptionNo>\S+)"
| table InvoiceExceptionNo