|eval _raw=replace(_raw,"(?m)\s+"," ") It was the line breaks i have in my _raw causing the issue. I was able to remove line breaks, and it's done the trick. ... View more

The start and end is definitely in the events. Does it matter as they are in different line? |rex field=_raw "16R:FIN(?<fin>[^\{]*)" Some content of the event as below using rex field, value of fin: :16R:FIA :12A::CLAS/ISIT/CORP :98A::MATU//20291201 :92A::INTR//2,375 :16S:FIA :90A::MRKT//PRCT/12,356 :93B::AGGR//UNIT/0000, :19A::HOLD//123,12 :16S:FIN :16R:FIN   ... View more

Below isn't working as well what am i doing wrong? When i remove these rex entries i am resulting in 1500 events. But 0 when add them back on. 0 events: index=abc |eval _raw=replace(_raw,"&#13;","") |rex field=_raw "{2:O(?<MessageType>.{3})" | rex max_match=0 ":16R:FIN (?<line>.+?):16S:FIN" | mvexpand line | rex field=line "35B:ISIN(?<ISIN>.{12})" | rex field=line "AGGR//(?<AGGR>.{1,20})" | rex field=line "AVAI//(?<AVAI>.{1,20})" |search MessageType="535" | table ISIN AGGR AVAI 1500 events: index=abc |eval _raw=replace(_raw,"&#13;","") |rex field=_raw "{2:O(?<MessageType>.{3})" |search MessageType="535" | table ISIN AGGR AVAI ... View more

I'm searching this within an index how do i write so it looks at the whole message. I need to further use other filters (search). Which is not working along with this. You've defined the _raw as content, i need to look at a specific rex field i've defined in midst of the query. | makeresults index=abc |eval _raw=replace(_raw,"&#13;","") |rex field=_raw "{2:O(?<MessageType>.{3})" | rex max_match=0 ":16R:FIN (?<line>.+?):16S:FIN" | mvexpand line | rex field=line "35B:ISIN(?<ISIN>.{12})" | rex field=line "AGGR//(?<AGGR>.{1,20})" | rex field=line "AVAI//(?<AVAI>.{1,20})" |search MessageType="535" | table ISIN AGGR AVAI ... View more

They're not in same order, some fields are repeated and some not, but each block open and close with 16R:FIN. Close with 16S:FIN. This is not working, and characters between each tag 93B is not constant.  I need them in unique line as the data before16S: is constant and should append to all reiterations. How can i split the below: 702250081 26XXXXX CLAS/ISIT/TD CLAS/ISIT/GOVT CLAS/ISIT/GOVT CLAS/ISIT/GOVT MATU//20240715 MATU//20240630 MATU//20240715 MRKT//PRCT/100, MRKT//PRCT/96,992 MRKT//PRCT/98,387 MRKT//PRCT/98,414   Expected events: 702250081 26XXXXX CLAS/ISIT/TD   MRKT//PRCT/100, 702250081 26XXXXX CLAS/ISIT/GOVT MATU//20240715 MRKT//PRCT/96,992 702250081 26XXXXX CLAS/ISIT/GOVT MATU//20240630 MRKT//PRCT/98,387 702250081 26XXXXX CLAS/ISIT/GOVT MATU//20240715 MRKT//PRCT/98,414   _raw: :20C::SEME//0000000702250081  :97A::SAFE//26XXXXX :16R:FIA :12A::CLAS/ISIT/TD :16S:FIA :90A::MRKT//PRCT/100, :16S:FIN :16R:FIN :16R:FIA :12A::CLAS/ISIT/GOVT :98A::MATU//20240715 :16S:FIA :90A::MRKT//PRCT/96,992 :16S:FIN :16R:FIN :16R:FIA :12A::CLAS/ISIT/GOVT :98A::MATU//20230630 :16S:FIA :90A::MRKT//PRCT/98,387 :16S:FIN :16R:FIN :16R:FIA :12A::CLAS/ISIT/GOVT :98A::MATU//20260815 :16S:FIA :90A::MRKT//PRCT/98,414 :16S:FIN :16S:SUBSAFE ... View more