$re = '/TextData=(?P<Query>[\w\W]*);NTCanonicalUserName/m';
$str = '[2020-05-28 16:01:47.868 +00:00] CurrentTime=5/28/2020 4:01:47 PM +00:00;StartTime=5/28/2020 4:01:47 PM +00:00;EndTime=5/28/2020 4:01:47 PM +00:00;EventClass=QUERY_END;EventSubclass=1;Severity=0;Success=1;Error=0;ConnectionID=2804894;ClientProcessID=4364;SPID=12255472;ErrorType=0;Duration=78;CPUTime=78;IntegerData=5;TextData=select [LAST_SCHEMA_UPDATE],[LAST_DATA_UPDATE] from $system.mdschema_cubes where ([CATALOG_NAME]=@p1);NTCanonicalUserName=xxx\\xxx;SessionID=F1E0DF9C-E2B2-48BD-BFF4-FB57D3868BC6;NTUserName=xxx;NTDomainName=xxxx;DatabaseName=xxx;ApplicationName=PowerBI - Model Change Tracker - Id 5902431 - Last Check 05/28/2020 00:31:26;ServerName=xxx\\xxx;RequestID=xxx-97d8-4259-a0aa-xxx;RequestID=xxxx-a430-418f-898a-37282d0ee2df[0];RequestID=xxxx-d7ed-4401-9856-c974c21017c2[24];';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php