title: Splunk: Trying to split multiline event at search time
body: <pre><code>2018-06-20T00:04:35.000+00:00 (980) WAL Autocheckpointing, name=C:\Program 
  Files\PriceService\data\documents.db
  2018-06-20T00:07:16.000+00:00 (980) WAL Autocheckpointing, name=C:\Program 
  Files\PriceService\data\store-promotions.db
  2018-06-20T00:07:21.000+00:00 (980) WAL Autocheckpointing, name=C:\Program 
  Files\PriceService\data\store-promotions.db
  2018-06-20T00:07:26.000+00:00 (980) WAL Autocheckpointing, name=C:\Program 
  Files\PriceService\data\store-promotions.db
  </code></pre>
  
  <p>I have been trying to get my splunk query right in order to split this one event into multiple events but for some reason I cannot get my query right.</p>
  
  <p>I tried to split on newline but the result set comes back unchanged. I understand from reading online I'm supposed to use something on the lines of </p>
  
  <pre><code>myQuery | rex field=_raw "\[(?P&lt;field1&gt;...).*[\r\n]"
  </code></pre>
  
  <p>Apologies by the way. My regex game is not strong.</p>