I have events that span multiple lines. One such event looks as follows:
... # User details ID: 123 Username: admin Group: admin Group: bin ...
Each event has at least one Group line.
I want to create a field extraction for the first occurence of Group.
So, for the example above the extracted field should have the value admin.
How do I create such a field extraction?