This is the search i am using to extract key/value from the field "RID" with multivalued "DEF" | rex max_match=0 field=RID "(?P<key>[A-Z]+)\s+:\s+(?P<value>[^\n|\"]+)\"?,?" RID= "ABC: ABC-2017-5715 DEF: 4057120 DEF : 4088779 DEF : 4088782 DEF : 4088786 XYZ : https://portal.msrc.microsoft.com/en-US/" This works fine while performed from the GUI and are extracted into new fields key & value. But the same thing when applied through transforms.conf doesnt extract anything. # extract multiple fields within source_key and give them key=value SOURCE_KEY = RID #REGEX = ([A-Z]+)\s+\:\s+([^\s|\n|\"]+)\"?,? REGEX = ([A-Z]+)\s+:\s+([^\n|\"]+)\"?,? FORMAT = $1::$2 MV_ADD = 1 The above is the extraction used in transforms.conf with appropriate reference in props.conf. Anybody who has faced something similar and been able to fix?
... View more