I am able to extract some fields, but not all from sample data as per below for 2 events. Please note that variable, type, and value occurs multiple times in an event and the number of recurrences can vary from one event to another. In the 1st event, these combinations (variable, type and value) occur 6 times, whereas in the 2nd event, only 2 times. How can I extract these fields at search time via props.conf?
REGEX = (\w+):\s([^\n\r\t]+
FORMAT = $1::$2
MV_ADD = True
MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which
* If set to true, the extractor makes the field a multivalued field and
appends the newly found value, otherwise the newly found value is
* Defaults to false