Search code examples
splunksplunk-query

Search over multiple lines regex

I try to find logs via search that contains a pattern over multiple log entries. E.g.

time n :Post Request xyz
time n1 :requestCode --> 401

I tried to use regex 

conf_file=xyz | regex "Post\sRequest\sxyz\r\n.*401"

I checked the regex with another editor and its working fine. However Splunk never finds a result. So my question is how can I search for that pattern over those two lines?

Solution

  • The regex command, like most other SPL commands, only looks at the current event. There are ways to combine events, like with transaction, and then use regex on the combined value.