Getting Data In

Multi-value fields not populating for index

ccollord
Explorer

Hello,
I think i'm doing something wrong, but i've read through all the manuals and can't figure out what it is!

I have an index named "email" that has entries that look like this:
[MAILTO]foo@bar.com [MAILTO]dog@cat.com [MAILFROM]cat@hat.com [SUBJECT]Hi there! ....

In my props.conf file:
[email] <--- this is the name of my index
MAX_TIMESTAMP_LOOKAHEAD = 40
TZ=UTC
REPORT-email = email-mv

In my transforms.conf file:
[email-mv]
REGEX = ([[^\s]+])([^\t]+)
FORMAT = $1$2
MV_ADD = true

I've been trying various things all morning and then doing " index=email | extract reload=T ". Any ideas what i'm missing?
Thanks!
~Chris

0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Two problems.

  1. props.conf must be in terms of sourcetype, source or host, not index.
  2. The format here should be $1::$2.

View solution in original post

0 Karma

ccollord
Explorer

Thank you! "email" was also my sourcetype name so i was okay there but the change to the FORMAT fixed it!

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Two problems.

  1. props.conf must be in terms of sourcetype, source or host, not index.
  2. The format here should be $1::$2.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...