https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440857#M125287 <P>I'm sorry. I had clicked the accept and given the karma points. It's completely working now.</P> Thu, 14 Mar 2019 18:53:45 GMT jeck11 2019-03-14T18:53:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440853#M125283 <P>This is the regex I've come up with so far. Unfortunately, it's either matching too much or not enough. I want it to match everything after "Details: " until the first time "java." is found. Basically, I'm looking for everything in the orange boxes in the example image below.</P> <PRE><CODE>^Details\:\s(?&lt;Error_Details&gt;.*)\sjava\.\w+\.\w+(\s|\:) </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6686i5F71E2804F2794ED/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 14 Mar 2019 16:42:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440853#M125283 jeck11 2019-03-14T16:42:02Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440854#M125284 <P>It would have been helpful to post the sample strings as text rather than as an image so we could test them in regex101.com.</P> <P>Have you tried <CODE>Details\:\s(?&lt;Error_Details&gt;[\s\S]*?)\sjava\.</CODE>?</P> Thu, 14 Mar 2019 16:56:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440854#M125284 richgalloway 2019-03-14T16:56:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440855#M125285 <P>I kind of see what you did there. The problem wasn't so much after the match as it was inside the match. </P> <P>Details:\s(?[\s\S]*?)\sjava.\w+.\w+</P> <P>Thank you very much for your assistance.</P> Thu, 14 Mar 2019 17:51:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440855#M125285 jeck11 2019-03-14T17:51:56Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440856#M125286 <P>Is it working now? If so, please accept the answer to help future readers. If not, please say where the answer is lacking.</P> Thu, 14 Mar 2019 18:50:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440856#M125286 richgalloway 2019-03-14T18:50:28Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440857#M125287 <P>I'm sorry. I had clicked the accept and given the karma points. It's completely working now.</P> Thu, 14 Mar 2019 18:53:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-field-extraction-match-up-till-the-first-time-a/m-p/440857#M125287 jeck11 2019-03-14T18:53:45Z