Interestingly, when I replace your transform.conf with the following: [getPlugin] REGEX = severity=\"3\".*?pluginName=\"([^\"]+) FORMAT = pluginName::$1 MV_ADD = true I get a multi-value field pluginName with 2 values SNMP & UNIX. So it's something to do with the extended regex you're using. To be honest, I'd be hesitant to use the Regex to filter data, instead I'd aim to add all the fields and then filter using Splunks native search capabilities. You never know when you might need to search using different criteria and by hard coding your results you limit that flexibility. As an aside - the xml as written is broken. The HostProperties tag doesn't seem to be closed. ... View more