https://community.splunk.com/t5/Splunk-Search/Extracting-fields/m-p/77952#M19715 <P>I think it depends on how you configure regex. Following is just example configuration in props.conf. </P> <P>[your_sourcetype]<BR /> EXTRACT-example_field1 = (?i)TIME:\s(?P<TIME>\d+)\s+<BR /> EXTRACT-example_field2 = (?i)FileNet Time:\s(?P<FILENET_TIME>\S+)\s+<BR /> EXTRACT-example_field3 = (?i)OnBase Time:\s(?P<ONBASE_TIME>\S+)\s+</ONBASE_TIME></FILENET_TIME></TIME></P> Mon, 28 Sep 2020 11:57:33 GMT Takajian 2020-09-28T11:57:33Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields/m-p/77951#M19714 <P>What is the most efficient way to extract 3 different search time and 2 different doc count and user and application info?</P> <P>2012-06-18 21:10:42,387 INFO [STDOUT] INFO - EasyDocSoap.documentSearch(84) | TOTAL SEARCH TIME: 600 ms. FileNet Time: 27 ms. FN Doc Count: 3 OnBase Time: 570 ms. OB Doc Count: 0 for APP2 and User: ABCD</P> Tue, 19 Jun 2012 01:23:42 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields/m-p/77951#M19714 kunadkat 2012-06-19T01:23:42Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields/m-p/77952#M19715 <P>I think it depends on how you configure regex. Following is just example configuration in props.conf. </P> <P>[your_sourcetype]<BR /> EXTRACT-example_field1 = (?i)TIME:\s(?P<TIME>\d+)\s+<BR /> EXTRACT-example_field2 = (?i)FileNet Time:\s(?P<FILENET_TIME>\S+)\s+<BR /> EXTRACT-example_field3 = (?i)OnBase Time:\s(?P<ONBASE_TIME>\S+)\s+</ONBASE_TIME></FILENET_TIME></TIME></P> Mon, 28 Sep 2020 11:57:33 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields/m-p/77952#M19715 Takajian 2020-09-28T11:57:33Z