topic Re: multivalue field extraction using props and transforms at search time. in Getting Data In

multivalue field extraction using props and transforms at search time.

abhisplunk1 — Mon, 27 Oct 2025 19:37:35 GMT

I have a field pluginText field which has plugin paths with multiple values, i want to extract each path

for example in a json event pluginText looks like:

{,..., "pluginText": "<plugin_output>\nNessus detected 8 installs of Microsoft OneDrive:\n\n Path : C:\\Users\\user1\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 22.238\n\n Path : C:\\Users\\user2\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 25.140\n\n Path : C:\\Users\\user3\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 21.180\n\n Path : C:\\Users\\user4\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 25.65\n\n Path : C:\\Users\\user5\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 21.220.\n\n Path : C:\\Users\\user6\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 25.179\n\n Path : C:\\Users\\user7\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 25.65\n\n Path : C:\\Users\\user8\\AppData\\Local\\Microsoft\\OneDrive\\\n Version : 21.220\n</plugin_output>", "....}

on search page \\n goes to new line, so i have written the following regex, on UI it's working to have multiple values
| rex max_match=15 field=pluginText "Path[\s\:]+(?<plugin_path>.*?)[\n\r]"

but when i tried to extract same with props and transforms using below, the extraction didn't work,
[logsourcetype]
REPORT-new_plugin_path = extracting_plugin_path

[extracting_plugin_path]
REGEX = Path[\s\:]+(?<plugin_path>.*?)[\n\r]
REPEAT_MATCH = true
MV_ADD = true

looking for working props and transforms for this kind of situation, thanks!

Re: multivalue field extraction using props and transforms at search time.

PrewinThomas — Tue, 28 Oct 2025 04:07:31 GMT

@abhisplunk1

Can you try below,

[extracting_plugin_path] SOURCE_KEY = pluginText REGEX = (?s)Path\s*:\s*(?<plugin_path>.+?)(\\r|\\n) REPEAT_MATCH = true MV_ADD = true

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: multivalue field extraction using props and transforms at search time.

PickleRick — Tue, 28 Oct 2025 10:06:07 GMT

https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.4/get-started-with-knowledge-objects/the-sequence-of-search-time-operations#ariaid-title2

KV_MODE-based extractions take place _after_ REPORT and EXTRACT so you can't rely on fields extracted with automatic json parsing in your transform. You might try to rewrite your extraction as a calculated field using text functions but that might be tricky.