Hi @gcusello , Thanks for the fast answer.   It definitly helped but I realised it's a bit more complicated that what i described. Your suggestion gives as output : first second third Where i'd like to have te full path until there x/y/first x/y/second x/y/third Because there might be for exemple : x/y/first x/z/second/random.pdf x/z/second/random.pdf x/y/third Not an expert in regex and even less in splunk regex synthax. Sorry if it sound like something so simple i should have found myself. ... View more