Retrieve a section of result with start and end string

[chiwee]

In Splunk, is it possible to initiate a search where I like to define a start and end string? For example I have a whole list of data. I am interested in capturing a section of those information.

The start string will always start with say "Error" and end of "Completed".

[Damien_Dallimor]

A couple of ways to approach this depending on how you interpret your question.

This will capture the data between ERROR and COMPLETED from the raw indexed event and keep only those events in the search results where a match occurred.

index=foo | rex field=_raw "^.*ERROR(?<iwantthispart>.*)COMPLETED.*$" | where iwantthispart != "" | table iwantthispart

[chiwee]

Hi Damien,

I am trying to edit my question to give clearer picture but always got an issue with the captcha.

Here is what I am planning to accomplish. I am doing some capturing of configuration from my network equipment. (You may see the sample of configuration below).

line vty 0 4
access-class 5 in
exec-timeout 5 0
transport input ssh
line vty 5 8
access-class 5 in
exec-timeout 15 0
transport input ssh
line vty 9 15
transport input none
!

Therefore the start line will be always “line vty” and end with “!”

Wonder is this achievable?