I try this and success. config on props.conf [testmv_add] => this is the sourcetype SHOULD_LINEMERGE = true REPORT-testmv_add = mv_addreport config on transforms.conf [mv_addreport] REGEX=PROCEDURE\s([^\s]+) FORMAT = ProcedureName::$1 MV_ADD=true ... View more

I hope this work. I use \s before GENID because there is value "RGENID" in your data. | rex field=_raw "\sGENID\s(?<gen_id>\d+)" ... View more