The date field sometimes has 2 spaces and sometimes 1 space, depending on whether the date is a single digit or double digit. eg.  May[space][space]9 vs  May[space]10 as a result the field extraction regex finds the wrong field in the first 10 days of the month.  sample regex that splunk comes up with  - ^(?:[^ \n]* ){9}(?P<ResponseTime>\d+) I would have expected this to be a common enough problem but I can't seem to google the answer 😞 TIA for your assistance for this regex Newbie     ... View more