I am capturing some machine data and am wondering if it is possible to grab more or fewer fields via field extraction based on a size field in the data itself? 1480823739.999999 bus device [6] aa bb ff 00 33 33 1480823741.999999 bus device [2] ab f0 with the [6] and [2] in the data being the size values respectively. My present field extraction regex looks like this: ^\s+\(\d+\.\d+\)\s+(?P<bus>\w{1,4})\s+(?P<device>\w{2,3})\s+\[(?P<data_len>\d)\]\s+ This gets me extracted up to the message bytes. While I can just import the data values as a single field, I would like to be able to pull each two hex characters into separate fields based on this size data. Expanding on my regex, if I add multiple byte extractions to cover all instances, the smaller messages will not be extracted. ^\s+\(\d+\.\d+\)\s+(?P<bus>\w{1,4})\s+(?P<device>\w{2,3})\s+\[(?P<data_len>\d)\]\s+(?P<byte0>\w[0-9A-F]+)\s+(?P<byte1>\w[0-9A-F]+)\s+(?P<byte2... This results in the 6 byte messages being trapped and none of the smaller messages will. Can I have Splunk create multiple >byte1<,>byte2<,>byteN<... extractions based on the >data_len< field? Thank you, Wilsonite ... View more