Here is the 6 lines in a log file that all come out together in the log but they are each different lines (not wrapped): I need to key the words "exceeded, max, stopped, snooze and "ERROR [Thread". 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Thread: Thread-24 exceeded max allowable time for single task 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Time diff: 38635091 max allowable diff: 36000000 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Time exceeded by 2635 sec 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Please note that this max allowable time is configurable inCTSServerService.xml file. Modify the following tags to have a higher value 90 60 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Stopping all threads... 2013-04-03 18:55:37,065 ERROR [Thread-15] com.documentum.services.thread.CTSThreadPoolManagerImpl - Will snooze now to allow running threads finish their job Basically the App folks want an alert from a saved search that pulls in all 6 of these lines (there is info on each line that they want to see so to speak). All 6 lines make up an error thread (could be any thread). I have this so far and the rex pipe will not put any data into my field, but the search works. So my regex needs to be able to not just think of this as 1 line I guess (I am not a regex guru yet...far from it). \bE(\w*)R\b\s.*| max | exceeded | Stopping | snooze In splunk search I got this relaibly catching just what I want, but it wont work if I try to pipe this through rex: I want the alert from the search to look pretty with a table format and rename command and time conversion. I just cant get rex to create a field or get REX to give me back anything other than one line at a time (IE: 6 searches). index=application sourcetype=documentum host=myserver01 ERROR AND "exceeded max" OR "max allowable" OR "Time exceeded" OR "Stopping all threads" OR snooze ... View more