Splunk Search

how to match new lines in splunk

ankithreddy777
Contributor

I have a event as below

nam=this is org name;
-this is hyta name;
-this is hju name;

falu= this is gao name

I need to match multiple lines. until the line "falu=". May I know how to match multiple lines.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@ankithreddy777 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma

woodcock
Esteemed Legend

You need to specify multiline like this:

Your Base Search | rex "(?ms)name=(?<YourField>(.+)[\r\n]+falu="

somesoni2
Revered Legend

Give this a try

your base search | rex "name=(?<YourField>(.+[\r\n]+)falu="
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...