https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129812#M35305 <P>Thank you, I will test this and get back to you.</P> Wed, 04 Feb 2015 12:46:27 GMT jlhamlet 2015-02-04T12:46:27Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129810#M35303 <P>Hi,</P> <P>I am indexing data with events in this format:</P> <P><CODE>Field1:value1|Field1:value2 .....</CODE></P> <P>In my transforms.conf i set the regex to :</P> <PRE><CODE>REGEX = (?&lt;_KEY_1&gt;[a-zA-Z]+):(?&lt;_VAL_1&gt;[^|]+) </CODE></PRE> <P>This only extracts Value1 for Field1 and seems to ignore Value2.</P> <P>I am a newbie to regex, can someone help me out here ?</P> <P>Note that the IFX (web interface) does not allow me to extract Value2 to Field1.</P> <P>Thank you,</P> Wed, 04 Feb 2015 11:13:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129810#M35303 jlhamlet 2015-02-04T11:13:49Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129811#M35304 <P>Add "MV_ADD = true" in your transforms.conf. By default Splunk will write results only if the field it's about to write to is empty. When you set MV_ADD to true, Splunk will instead add the new value to the existing field, and make it multivalued.</P> Mon, 28 Sep 2020 18:49:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129811#M35304 Ayn 2020-09-28T18:49:59Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129812#M35305 <P>Thank you, I will test this and get back to you.</P> Wed, 04 Feb 2015 12:46:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129812#M35305 jlhamlet 2015-02-04T12:46:27Z https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129813#M35306 <P>Thank You very much for your help. It worked perfectly.</P> <P>Regards,</P> Wed, 04 Feb 2015 21:28:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-and-configure-transforms-conf-to-extract/m-p/129813#M35306 jlhamlet 2015-02-04T21:28:56Z