How to extract fields from multiline events at search time using props.conf?

[ashabc]

I am able to extract some fields, but not all from sample data as per below for 2 events. Please note that variable, type, and value occurs multiple times in an event and the number of recurrences can vary from one event to another. In the 1st event, these combinations (variable, type and value) occur 6 times, whereas in the 2nd event, only 2 times. How can I extract these fields at search time via props.conf?

>>>> 02 Dec 2016 11:11:58 - Unhandled (Source not monitored)

SNMPv2 Trap (enterpriseSpecific = 83)
Generic: 6
Specific: 83
Enterprise Oid: 1.3.6.1.4.1.14179.2.6.3
Source: 10.x.x.x
Community: xxxxx
Variable: 1.3.6.1.2.1.1.3.0
Type: Time Click
Value: 1827840700
Variable: 1.3.6.1.6.3.1.1.4.1.0
Type: OID
Value: 1.3.6.1.4.1.14179.2.6.3.83
Variable: 1.3.6.1.4.1.14179.2.2.1.1.1.0
Type: String
Value: 00-50-56-8A-18-62
Variable: 1.3.6.1.4.1.14179.2.2.1.1.3.0
Type: String
Value: 
Variable: 1.3.6.1.4.1.14179.2.5.22.1.2.0
Type: Integer
Value: 4
Variable: 1.3.6.1.4.1.14179.2.6.2.69.0
Type: Integer
Value: 2



>>>> 02 Dec 2016 14:00:33 - Unhandled (Source not monitored)

SNMPv1 Trap (enterpriseSpecific = 1)
Generic: 6
Specific: 1
Enterprise Oid: 1.3.6.1.4.1.9.9.43.2
Source: 10.x.x.x
Community: xxxxx
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.3.60802
Type: Integer
Value: 2
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.4.60802
Type: Integer
Value: 2
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.5.60802
Type: Integer
Value: 3

[sundareshr]

Try this

props.conf

REPORT-kvpairs = kvpairs

transforms.conf

[kvpairs]
REGEX = (\w+):\s([^\n\r\t]+
FORMAT = $1::$2
MV_ADD = True

MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which
already exists.
* If set to true, the extractor makes the field a multivalued field and
appends the newly found value, otherwise the newly found value is
discarded.
* Defaults to false