https://community.splunk.com/t5/Getting-Data-In/EXTRACT-repeatable-values-from-1-event/m-p/38614#M7146 <P>Oh! great! <BR /> sed is a very usefull command</P> <P>I add to sourcetype in props.conf </P> <P><CODE>SEDCMD = s/PARAM_.*="%.*"//g</CODE></P> <P>and template values has been deleted!</P> Sat, 18 Aug 2012 15:40:02 GMT sadon 2012-08-18T15:40:02Z https://community.splunk.com/t5/Getting-Data-In/EXTRACT-repeatable-values-from-1-event/m-p/38613#M7145 <P>I have an event in follow format:</P> <PRE><CODE>param_c="%s" param_b="%d" param_c="intrested data" param_b="1200" </CODE></PRE> <P>When in insert<BR /> KV_MODE=MULTI into props.conf<BR /> i have get:</P> <PRE><CODE>FIELD: PARAM_C___C VALUE: PARAM_C="intersted data" </CODE></PRE> <P>KV_MODE=auto:</P> <PRE><CODE>PARAM_C="%C" </CODE></PRE> <P>How i can get my "intrested" data in search-time index?</P> Sat, 18 Aug 2012 11:00:14 GMT https://community.splunk.com/t5/Getting-Data-In/EXTRACT-repeatable-values-from-1-event/m-p/38613#M7145 sadon 2012-08-18T11:00:14Z https://community.splunk.com/t5/Getting-Data-In/EXTRACT-repeatable-values-from-1-event/m-p/38614#M7146 <P>Oh! great! <BR /> sed is a very usefull command</P> <P>I add to sourcetype in props.conf </P> <P><CODE>SEDCMD = s/PARAM_.*="%.*"//g</CODE></P> <P>and template values has been deleted!</P> Sat, 18 Aug 2012 15:40:02 GMT https://community.splunk.com/t5/Getting-Data-In/EXTRACT-repeatable-values-from-1-event/m-p/38614#M7146 sadon 2012-08-18T15:40:02Z