Here's the text string from the log I'm searching: store license for Store 123456 2022-04-07 19:17:44,360 ERROR path not found   Here's my splunk search: index=* host="storelog*" "store license for " |rex field=_raw "Store\s123456\n\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\,\d{3}\s(?P<errortext>.*)path" | stats count by errortext   Why am I getting the following when I search? No results found. ... View more

Sample text from a log that I'm searching: "store license for Store 123456 2022-03-27 02:01:59,649 [XNIO-2 task-3] ERROR" I'm trying to search for, and return, a store number that's associated with a particular error. The following search successfully returns the store number (and count): index=* host="log*" "store license for" | rex field=_raw "Store\s(?P<storenumber>.*)" | stats count by storenumber But when I try to search for the storenumber along with error string that follows it, I get "no results found." Here's the search i'm trying: index=* host="log*" "store license for" | rex field=_raw "Store\s(?P<storenumber>.*)[\r\n]+2022\-03\-27\s02:01:59,649\s\[XNIO-2\stask-3\]\sERROR" | stats count by storenumber Splunk doesn't seem to like the newline character. I've tried \n and [r\n\] and others, but all with the same incorrect results. ... View more