What is the usage of "(?msi)" in Splunk with rex comamnd?

[admin12345678]

Hi,
I am having some problem to understand the usage of "(?msi)" with rex command,please help me regarding that?

[gcusello]

Hi @admin12345678,
as you can see in regex101 the meaning of (?msi) is:

(?msi) match the remainder of the pattern with the following effective flags: gmsi
m modifier: multi line. Causes ^ and $ to match the begin/end of each line (not only begin/end of string)
s modifier: single line. Dot matches newline characters
i modifier: insensitive. Case insensitive match (ignores case of [a-zA-Z])

Ciao.
Giuseppe

[admin12345678]

Thanks @gcusello, can you please explain me more about the m modifier?

[gcusello]

Hi @admin12345678,
you have to use the m modifier when you have a multi line log (e.g. wineventlog).

The best approach is to use it in regex101, e.g. with a wineventlog sample.

Ciao.
Giuseppe