Regex to extract next 5 lines after keyword

[thaghost99]

hi i would like some help on how to extract the next 5 lines after a keyword where it extracts the full line where the keyword is part of.

example below....

where the keyword is the 'ethernet'

**********************************************

Redundant-ethernet Information:
Name Status Redundancy-group
reth0 Down Not configured
reth1 Up 1
reth2 Up 1
reth3 Up 1
reth4 Down Not configured
reth5 Down Not configured
reth6 Down Not configured
reth7 Down Not configured
reth8 Down Not configured
reth9 Up 2

Redundant-pseudo-interface Information:
Name Status Redundancy-group
lo0 Up 0

*****************************************

example value of a field now would be..

Redundant-ethernet Information:
Name Status Redundancy-group
reth0 Down Not configured
reth1 Up 1
reth2 Up 1
reth3 Up 1

thanks, if it can be generic enough enough so that i can use it for other rex searches that of similar data 

[gcusello · Accepted solution]

Hi @thaghost99,

please try this regex:

(?<my_field>.*ethernet[^\n]+(\n.*){5})

that you can test at https://regex101.com/r/6MlmNV/1

Ciao.

Giuseppe

[thaghost99]

oh man. you are super fast @gcusello,

and it works just how i want it to.. 🙂 you are amazing. thank you very very much.

[gcusello]

Hi @thaghost99,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[thaghost99]

thank you @gcusello  solution accepted.

side question or easy one. i was googling how to increase the width of an input field, but i see mostly html, but i only have <form> on mine

how can i change the width of the below input? 

<input type="multiselect" token="field1" searchWhenChanged="true">
<label>Select Hostname</label>
<fieldForLabel>Hostname</fieldForLabel>
<fieldForValue>Hostname</fieldForValue>
<search>
<query>index = 1234 </query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<delimiter> OR </delimiter>
</input>

[gcusello]

Hi @thaghost99,

for a new question is always better to open a new case, so more people can help you.

In this case, the only way is to modify the CSS, but I cannot help you in this.

Ciao.

Giuseppe