How to write the regex and configure transforms.conf to extract multiple values for one field?

[jlhamlet]

Hi,

I am indexing data with events in this format:

Field1:value1|Field1:value2 .....

In my transforms.conf i set the regex to :

REGEX =  (?<_KEY_1>[a-zA-Z]+):(?<_VAL_1>[^|]+)

This only extracts Value1 for Field1 and seems to ignore Value2.

I am a newbie to regex, can someone help me out here ?

Note that the IFX (web interface) does not allow me to extract Value2 to Field1.

Thank you,

[Ayn · Accepted solution]

Add "MV_ADD = true" in your transforms.conf. By default Splunk will write results only if the field it's about to write to is empty. When you set MV_ADD to true, Splunk will instead add the new value to the existing field, and make it multivalued.

[jlhamlet]

Thank You very much for your help. It worked perfectly.

Regards,

[jlhamlet]

Thank you, I will test this and get back to you.