Regular Expression two words pattern

[royimad]

Hello Splunkers,

I have a log file as follow:
Time1 WARN a.b.c
Time2 ERROR 1.2.3
Time3 FATAL a.b.c
Time2 WARN a.b.c
Time4 WARN a.b.c

If i want to select all the fields after WARN , i can write a regular expression as:
(?i) WARN (?P[^ ]+)
This will select all the fields after WARN.

What do i need to change if i want to select with the same regular expression the fields after ERROR with the fields after WARN?

Thanks,

[kristian_kolb]

a) Time1 WARN some message here
b) Time2 ERROR some other message
c) Time3 FATAL yet another message

Given the events above, the following will happen

regex                                       your_field
(?i)(?:WARN|ERROR|FATAL)(?<your_field>[^ ]+)            some, some, yet (respectively)
(?i)(?:WARN|ERROR|FATAL)(?<your_field>.+)               the remainder of the events (including spaces)
(?i)(?:WARN|ERROR)(?<your_field>[^ ]+)                  some, some, null(respectively)

/k