Probably reaching catastrophic backtracking because of the greedy .* before "OperationCode=" . That is going to take everything in the entire 56K until it hits the end, then back up and look for the very last place it finds "OperationCode=" before the end. Sometimes you want that behavior, but not in this case. Instead, you want it to be lazy, and stop slurping its soup the first time it encounters "OperationCode=" . Change that middle snippet to this... we're just adding a question mark to make the .* before "OperationCode=" become "lazy" instead of "greedy". \".*?OperationCode=\" ... View more

Is this a bug from Splunk? ... View more