| set diff [| tstats count where source_1 by host | table host] [| tstats count where source_2 by host | table host] That SPL provides a list of all of the hosts not seen in source_2 The search is not wrong but the last statement is inaccurate because set diff as shown produces a list of all hosts in source_1 not seen in source_2, plus all hosts in source_2 not seen in source_1. (The statement is correct only if hosts in source_2 is a subset of that in source_1.  Maybe this is a condition known in your use case?)  So, it is equivalent to the search I posted in this one. To get list of only those hosts in source_1 that are not in source_2, use my search in this earlier one or, as @PickleRick suggested, improve it with tstats like   | tstats values(host) as host where source_1 NOT [tstats values(host) as host where source_2]   If hosts in source_2 is a subset of that in source_1 as may be the case, this method will produce the exact same result, and will still be more efficient.

Splunk uses pcre but there is some difference.  I have a hard time trusting it with multiline.  Your code sample in my vanilla 9.1.2 installation, for example, results in 77777777* alone. Because your ANSI 835 is strictly formatted, maybe split will suffice. | eval clmevent = mvindex(split(_raw, " CLP*"), 1, -1) ``` extra newline is paranoia - sample works without ``` | mvexpand clmevent Your sample event gives me all three.  Here is an emulation you can compare with real data | makeresults | fields - _time | eval _raw="N4*Carson*NV*89701~ PER*BL*Nevada Medicaid*TE*8776383472*EM*nvmmis.edisupport@dxc.com~ N1*PE*SUMMER*XX*6666666666~ REF*TJ*111111111~ CLP*77777777*4*72232*0**MC*6666666666666~ CAS*OA*147*50016*0~ CAS*CO*26*22216*0~ NM1*QC*1*TOM*SMITH****MR*77777777777~ NM1*74*1*ALAN*PARKER****C*88888888888~ NM1*PR*2*PACIFI*****PI* 9999~ NM1*GB*1*BARRY*CARRY****MI*666666666~ REF*EA*8888888~ DTM*232*20180314~ DTM*233*20180317~ SE*22*0001~ ST*835*0002~ BPR*H*0*C*NON************20180615~ TRN*1*100004765*5555555555~ DTM*405*20180613~ N1*PR*DIVISON OF HEALTH CARE FINANCING AND POLICY~ N3*1100 East William Street Suite 101~ N4*Carson*NV*89701~ PER*BL*Nevada Medicaid*TE*8776383472*EM*nvmmis.edisupport@dxc.com~ N1*PE*VALLEY*XX*6666666666~ REF*TJ*530824679~ LX*1~ CLP*77777778*2*3002*0**MC*6666666666667~ CAS*OA*176*3002*0~ NM1*QC*1*BOB*THOMAS****MR*55555555555~ NM1*74*1*ALAN*JACKSON****C*66666666666~ REF*EA*8888888~ DTM*232*20171001~ DTM*233*20171002~ CLP*77777779*4*41231.04*0**MC*6666666666668~ CAS*OA*147*9365.04*0~ CAS*CO*26*31866*0~ NM1*QC*1*HELD*ALLEN****MR*77777777778~ NM1*74*1*RYAN*LARRY****C*88888888889~ NM1*PR*2*SENIOR*****PI* 8888~" ``` data emulation above ``` Hope this helps.