Splunk Search

How to search over multiple lines

ahmet_goekduman
New Member

Hello together,

I want to search for "Binding Type: 0" in the following example log:

LogName=Directory Service
SourceName=Microsoft-Windows-ActiveDirectory_DomainService
EventCode=2889
EventType=4
Type=Information
ComputerName=XXXXX
User=NOT_TRANSLATED
Sid=S-1-5-7
SidType=0
TaskCategory=LDAP Interface
OpCode=The operation completed successfully.
RecordNumber=7362133
Keywords=Classic
Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.
Client IP address:
1.1.11.1:5555
Identity the client attempted to authenticate as:
XXX\XXXX
Binding Type:
0

The problem is that the value 0 is a new line.
Do you know how can I search for this?

Please help.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
you can use the regex command, something like this:

your_search
| regex "(?ms)Binding\s+Type:\s+0"
| ...

You can test the regex at https://regex101.com/r/B7f8Yz/1 .

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...