- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num
. I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[JobEventLog]
TRANSFORMS-error_num = mvfield_error_num
transforms.conf:
[mvfield_error_num]
SOURCE_KEY = _raw
REGEX = ERROR_:(?<error_num>d{5})
MV_ADD = true
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you wanting to do this extraction at search time (which is most common) or index time? Your transforms.conf stanza looks like a search time extraction however your props.conf is referring to it as an index_time configuration. (Search time uses REPORT-name
index time uses TRANSFORMS-name
)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you wanting to do this extraction at search time (which is most common) or index time? Your transforms.conf stanza looks like a search time extraction however your props.conf is referring to it as an index_time configuration. (Search time uses REPORT-name
index time uses TRANSFORMS-name
)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you acharlieh. I want to do the extraction at search time. I changed the props.conf to "REPORT" and it is working correctly now. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to hear it helped! Converted my comment to an answer so it can be accepted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Are your permissions correct (is it private to another user than the one searching)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

There is an underscore before "raw" but it doesn't show.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Just edited it for ya @edrivera3. I usually highlight config stanzas and click on the "Code Sample" button in the editor to render special characters properly for regex.
Also, you should include some sample data for users to better help you out, especially when it comes to regex and field extraction related questions.
