Answer by warren for Regular expression to exclude UUID from capture group

Instead of trying to capture everything but a [possibly-present] UUID, just remove it instead (and then remove extra spaces):

index=ndx sourcetype=srctp message=*
| eval error_msg=replace(message,"\w{8}-\w{4}-\w{4}-\w{4}-\w{12}","")
| eval error_msg=replace(error_msg,"\s+"," ")

If you know that the UUID is always contained inside whitespace, you could make the first replace() more efficient thusly:

| eval error_msg=replace(message,"\s\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\s","")

from User warren – Stack Overflow https://stackoverflow.com/questions/73204968/regular-expression-to-exclude-uuid-from-capture-group/73207403#73207403
via IFTTT