Hi, folks. I've been tinkering around these 2 weeks and finally found a solution. Sort of. This is basically a haphazard workaround. The first thing I did was trying make it more readable. Instead of ABCDE, I used A B C D E. Basically putting a delimiter between characters. Thus, my regex also changed into something like this (?=(?<field1>\w\s\w\s\w)) That regex didn't work, unfortunately. Then I wonder if the regex actually need something to anchor on. So, I manipulated my original text again by adding a space before A. My regex became like this \s(?=(?<field1>\w\s\w\s\w)) I got my intended results, but I still wonder why Splunk's regex engine behaves like that. NOTE: I had to use \w\s\w\s\w since ..... or .{5} didn't work when I tried them. NOTE2: The delimiter between characters and the "anchor" before the first character must be EXACTLY THE SAME. Full SPL: | makeresults | eval text="ABCDEFG" | rex field=text mode=sed "s/(\w)/\1 /g" | eval text=" "+text | rex field=text max_match=0 "\s(?=(?<field1>\w\s\w\s\w))"   Screenshot attached ... View more