When extracting a field using a regex, what does the P argument do (the P character between the question mark and the field name)? I have seen examples with and without this argument, but I don't see any obvious difference in the results. For example: (?i) Finished (?P .+) versus (?i) Finished (? .+) I looked in the Splunk manual and on the Answers site but couldn't find any description of this argument. Apologies if I'm missing something obvious. ... View more