Almost 5 years to the day after the last reply to this thread, and this issue still hasn't been resolved in Splunk. Our situation is slightly different;  we have raw csv data which is processed via regex captures in in-line field extractions (EXTRACT-)  in props.conf.  The caveat for this type of field extraction is that only one single regex can be used. For years this has worked great, but recently for the same "source", 2 additional fields have been added, making the existing extraction not work. To compensate, I've retooled the regex using a conditional if/then/else lookahead to test if N+2 fields exist.  If so, process through the "then" regex, otherwise the "else". Here's the regex: (?J)^[^,\n]*,(?(?=([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+))((?P<retailer>[^,]+),(?P<storeNumber>[^,]+),(?P<displayName>[^,]+),(?P<button>[^,]+),(?P<buttonSelection>[^,]+),(?P<activeDevice>[^,]+),(?P<swVersion>[^,]+),(?P<contentVersion>[^,]+),(?P<platform>[^,]+),(?P<configType>[^,]+),(?P<presses>[^,]+))|((?P<retailer>[^,]+),(?P<storeNumber>[^,]+),(?P<displayName>[^,]+),(?P<button>[^,]+),(?P<swVersion>[^,]+),(?P<contentVersion>[^,]+),(?P<platform>[^,]+),(?P<configType>[^,]+),(?P<presses>[^,]+))) Here are examples of the two possible data: Original: 20210727,some_retailer,950,display-10,someButton,7.99.9966,2021.07.11-USA,platformX,PLAYER_MASTER,35 New data: 20210727,some_retailer,950,display-10,someButton,THIS IS THE BUTTON SELECTION,BIG-DEVICE,7.99.9966,2021.07.11-USA,platformX,PLAYER_MASTER,35 This works very well on regex101.com.  Captures populate as expected depending on the number of comma-delimited values present. Sadly, when I push the change to my dev Splunk, it doesn't work.  For the original data (i.e., with 2 less fields), all fields get extracted.  However for the newer data, ONLY the two new fields get extracted.   It's as if the Splunk regex engine isn't implementing PCRE2 correctly, in particular the (?J). Unfortunately I don't have the privilege of writing tickets, but I do believe it's a Splunk error. With all that being said, do any of you gurus out there know another way to write a single regex that I could try to accomplish this? Many thanks in advance!  ... View more