Hi,
I am having some problem to understand the usage of "(?msi)" with rex command,please help me regarding that?
Hi @admin12345678,
as you can see in regex101 the meaning of (?msi) is:
(?msi) match the remainder of the pattern with the following effective flags: gmsi
m modifier: multi line. Causes ^ and $ to match the begin/end of each line (not only begin/end of string)
s modifier: single line. Dot matches newline characters
i modifier: insensitive. Case insensitive match (ignores case of [a-zA-Z])
Ciao.
Giuseppe
Thanks @gcusello, can you please explain me more about the m modifier?
Hi @admin12345678,
you have to use the m modifier when you have a multi line log (e.g. wineventlog).
The best approach is to use it in regex101, e.g. with a wineventlog sample.
Ciao.
Giuseppe