Hello, I have a case where I need to do regex  and I built my regex using regex101, everything works great and catchs everything there But I encountred an issue where splunk won't accept optional groups "(\\\")?", it'll give the error of unmatched closing parenthesis until you add another closing bracket like so: "(\\\"))?" And another issue I encountred is after I add this closing bracket, the regex will work, but not consistently. Here's what I mean: That's a part of my regex:     \[\{(\\)?\"PhoneNumber(\\)?\":(\\)?\"(?<my_PhoneNumber>[^\\\"]+     Won't work until I add more brackets to the optional groups like I mentioned before:     \[\{(\\))?\"PhoneNumber(\\))?\":(\\))?\"(?<my_PhoneNumber>[^\\\"]+       second issue: adding another part will still work:     \[\{(\\))?\"PhoneNumber(\\))?\":(\\))?\"(?<my_PhoneNumber>[^\\\"]+)\S+OtherPhoneNumber(\\))?\":(\\))?(\"))?(?<myother_PhoneNumber>[^,\\\"]+|null)       Adding a third part with the exact same format as the second part won't, will give the error of unmatched closing parenthesis again:     \[\{(\\))?\"PhoneNumber(\\))?\":(\\))?\"(?<my_PhoneNumber>[^\\\"]+)\S+OtherPhoneNumber(\\))?\":(\\))?(\"))?(?<myother_PhoneNumber>[^,\\\"]+|null)\S+Email(\\))?\":(\\))?(\"))?(?<email>[^,\\\"]+|null)       Am I missing something? I know the regex itself works   Sample data of the original log:   [{"PhoneNumber":"+1 450555338","AlternativePhoneNumber":null,"Email":null,"VoiceOnlyPhoneNumber":null}]   [{\"PhoneNumber\":\"+20 425554005\",\"AlternativePhoneNumber\":\"+1 455255697\",\"Email\":\"Dam@test.com.us\",\"VoiceOnlyPhoneNumber\":null}]"}   [{\"PhoneNumber\":\"+1 459551561\",\"AlternativePhoneNumber\":\"+1 6155555533\",\"Email\":null,\"VoiceOnlyPhoneNumber\":\"+1 455556868\"}] ... View more

Editing to make it better: Let's say I have login events with 2 important fields: past_deviceid, new_deviceid I want to check if the new_deviceid was assigned to a different user in the past, for that I need to compare the value of the field to the past_deviceid field of past events and I'm kinda stuck here In login events where the user uses their usual device, there'll be only 1 field called past_deviceid, we get the new_deviceid field only when there's a login with a new device In the end I want to have a table that shows the new_deviceid by all the users that hold/held it where there's more than 1 user Example: events with only 1 device: User: Josh old_Device: iPhone12348 --------------------------- User: John old_Device: samsung165 ---------------------------- case where there's a new device: User: Jane old_Device: iPhone17778 new_Device: samsung165   I want to have the following table, I guess the stats command fits here: DeviceID User samsung165 Jane John ... View more