https://community.splunk.com/t5/Splunk-Search/How-to-repeat-a-regex-to-match-more-than-one-instances/m-p/676429#M231354 <P>Yes. The additional options are one of the reasons for using TRANSFORM-based exractions instead of REPORT.</P><P>Notice, however, that REPEAT_MATCH is for index-time extractions.&nbsp; You might want to consider MV_ADD</P> Fri, 02 Feb 2024 20:00:13 GMT PickleRick 2024-02-02T20:00:13Z https://community.splunk.com/t5/Splunk-Search/How-to-repeat-a-regex-to-match-more-than-one-instances/m-p/676426#M231353 <P>Hi,</P><P>We are using following regex to capture "caused by" exceptions within java stack trace.</P><LI-CODE lang="markup">Caused by: (?P&lt;Exception&gt;[^\r\n]+)</LI-CODE><P>&nbsp;</P><P>When testing in regex101, it seems to be working well. Captures both instances of "caused by" in the sample trace.</P><P><A href="https://regex101.com/r/yL1ucO/1" target="_self">https://regex101.com/r/yL1ucO/1</A>&nbsp;</P><P>But when used with EXTRACT within props.conf, Splunk only gets the first instance, i.e. "SomeException". 2nd occurrence, "AnotherException" is not captured.</P><P>Should I be using REPEAT_MATCH with transforms stanza, or is there a way to fix this within props itself?</P> Fri, 02 Feb 2024 19:25:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-repeat-a-regex-to-match-more-than-one-instances/m-p/676426#M231353 att35 2024-02-02T19:25:49Z https://community.splunk.com/t5/Splunk-Search/How-to-repeat-a-regex-to-match-more-than-one-instances/m-p/676429#M231354 <P>Yes. The additional options are one of the reasons for using TRANSFORM-based exractions instead of REPORT.</P><P>Notice, however, that REPEAT_MATCH is for index-time extractions.&nbsp; You might want to consider MV_ADD</P> Fri, 02 Feb 2024 20:00:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-repeat-a-regex-to-match-more-than-one-instances/m-p/676429#M231354 PickleRick 2024-02-02T20:00:13Z