getting an error while doing field extraction for the logs via syslog

[markcomlinks]

Good morning Team
i am quite new in splunk and am stuck here currently

trying to extract fields for following strings sourcetype is syslog (The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.)
MN category\Source: Local databases\r\nRule\Category: TEST CAtegory\r\nRule\Rule type: Test\r\n

field to be selected

MN Category\Source local database
Rule\Category TEST category
Rule\Rule Type: Test

Thank you in advance

[micahkemp]

It looks like each key/value pair is on its own line, and the keys are separated from the values by a :. This may be a valid regex to use in transforms.conf to extract the key/value pairs together:

[colon_separated_key_value]
REGEX = ^(?<_KEY_1>[^:]+):\s*(?<_VAL_1>.*)$

And in props.conf:

[syslog]
REPORT-colon_separated_key_value = colon_separated_key_value

Check out the transforms.conf and props.conf documentation for more information.