Hi @meetmshah  not working as expected. search :- log_type=Passed_Authentications MESSAGE_TEXT="Command Authorization succeeded"  | rex field=CmdSet max_match=0 "CmdAV=(?<Command>[^\s]+)|\sCmdArgAV=(?<Command1>[^\s]+)" | makemv delim="," allowempty=t Command1 | table _time,Command,Command1 ... View more

@meetmshahthanks 'max_match=0' helped. but command keywords are separated by 'Enter'. is there any options to keep all words in one line?   ... View more

hi @meetmshah  thanks for your reply. but not working as expected   ... View more

Hello @meetmshah  i would like to thank you for your reply. but i am looking to extract 'CmdSet' field. i am using 'rex field=CmdSet "CmdAV=(?<Command>[^\s]+)|\sCmdArgAV=(?<Command1>[^\s]+)" ' but it is giving output till 1st CmdArgAV value     ... View more

TACACS event: Mar 26 15:37:59 <device_IP> <device_name>_Passed_Authentications 0045846127 2 0 2024-03-26 14:37:59.011 +00:00 06024423114 5202 NOTICE Device-Administration: Command Authorization succeeded, ConfigVersionId=1398, Device IP Address=<device_IP>, DestinationIPAddress=<device_IP>, DestinationPort=49, UserName=<user>, CmdSet=[ CmdAV=show CmdArgAV=running-config CmdArgAV=interface CmdArgAV=Ethernet1/19 CmdArgAV=<cr> ], Protocol=Tacacs, MatchedCommandSet=Unsafecommand, RequestLatency=10, NetworkDeviceName=<device_name> ... View more