https://community.splunk.com/t5/Getting-Data-In/Extracting-Fields-using-Regex/m-p/394110#M99265 <P>it looks like all your headers are separated by a tab.<BR /> I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter. </P> Mon, 22 Jul 2019 13:41:29 GMT chinmoya 2019-07-22T13:41:29Z https://community.splunk.com/t5/Getting-Data-In/Extracting-Fields-using-Regex/m-p/394109#M99264 <P>Hi All, </P> <P>TIME_PREFIX=<BR /> MAX_TIME_LOOKAHEAD=<BR /> LINE_BREAKER=</P> <P>Below are the logs which need to be extracted. Kindly help!</P> <P>LOGID USERTYPE OPERATORUSER OPERATORTYPE OPERATORNAME OPERATORTIME<BR /><BR /> 6 ma*<EM>ge_a</EM><STRONG>n userClass deleteUser 2019-06-28 09:50:26<BR /> 7 System administrator ma</STRONG>ge_a***n userClass createUser 2019-06-28 09:50:3</P> <P>Thanks in Advance!</P> Wed, 30 Sep 2020 01:21:34 GMT https://community.splunk.com/t5/Getting-Data-In/Extracting-Fields-using-Regex/m-p/394109#M99264 EHariharan 2020-09-30T01:21:34Z https://community.splunk.com/t5/Getting-Data-In/Extracting-Fields-using-Regex/m-p/394110#M99265 <P>it looks like all your headers are separated by a tab.<BR /> I would suggest you not use regex instead use a delimiter based approach with using tab as a delimiter. </P> Mon, 22 Jul 2019 13:41:29 GMT https://community.splunk.com/t5/Getting-Data-In/Extracting-Fields-using-Regex/m-p/394110#M99265 chinmoya 2019-07-22T13:41:29Z