Multiple values, same field -- how?

[the_wolverine]

I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. For example, I have the following event that contains lines from ldap:

(this is in one event)

memberOf: CN=tina
memberOf: CN=toby
memberOf: CN=ben

My field extraction looks like this:

(?i)memberOf: (?P<memberOf>[^\n]+) 

Splunk only pulls out the first instance of memberOf (CN=tina) and ignores the others. Is there a simple solution for this?

[the_wolverine · Accepted solution]

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true

[the_wolverine]

w00t. Thanks Ledion and Stephen!

[Stephen_Sorkin]

REPORT-memberOf = multivalue_ldif. The EXTRACT signifies inline regex.

[gkanapathy]

I edited your source event data to match the regex. Please verify that I edited it correctly. Thanks.