I am trying to extract a field using field transformation. My event contains a XML. Partial snippet given below -   <Name>/xx</Name> <Id>HASPR00100</Id> <Class>B</Class> <Confidence>0.8957</Confidence> <Notes> <Note> <Key name="note">[CDATA[{"target": "corp", "precision": 0.365, "recall": 0.553, "fnr": 0.447, "fpr": 0.0273, "confidence": {"A": 0.0, "B": 0.8957}}]]</Key> <Key name="score">0.0271</Key>   I am trying to capture the "score" value 0.0271 in a field. I tried to create a field transformation using regex below  - \<Name\>\/xx\<\/Name\>\n.+\n.+\n.+\n.+\n.+\n.+\n.+\<Key name\=\"score\"\>(\S+)\<\/Key\> But that does not work. If I use the same expression in rex I am able to extract the field. index=a ... | rex "\<Name\>\/xx\<\/Name\>\n.+\n.+\n.+\n.+\n.+\n.+\n.+\<Key name\=\"score\"\>(?<sc>.*)\<\/Key\>" Am i missing something? Or is there any better way to do this? Thanks. ... View more