How to extract fields with same name for visualization?

[cpramuk]

I'm trying to extract and dashboard the latest number in my logs for each "7d" stat.

Some sample logs:

[db]: 00:05:01.000: 3ddesigns:total 173304125

[db]: 00:05:01.000: 3ddesigns:1d 253113

[db]: 00:05:01.000: 3ddesigns:7d 1435675

[db]: 00:05:01.000: 3ddesigns:30d 5863610

[db]: 00:05:01.000: 3dlessons:total 92148058

[db]: 00:05:01.000: 3dlessons:1d 103077

[db]: 00:05:01.000: 3dlessons:7d 539695

[db]: 00:05:01.000: 3dlessons:30d 2216809

[db]: 00:05:01.000: circuitsdesigns:total 62150103

[db]: 00:05:01.000: circuitsdesigns:1d 125770

[db]: 00:05:01.000: circuitsdesigns:7d 724227

[db]: 00:05:01.000: circuitsdesigns:30d 2936667

I have a search query but it gives me a Null field...is there a way to rename the fields?:

obs_mnkr="tnkrcad-p-ue1" source="/disk/logtxt/stats.log" 
| multikv noheader=t 
| fields _raw 
| rex "3ddesigns:(?<designs>\w+)\s+(?<num>\d+)"
| regex designs!="1d" 
| regex designs!="30d" 
| regex designs!="total" 
| rex "circuitsdesigns:(?<circuits>\w+)\s+(?<num>\d+)"
| regex circuits!="1d" 
| regex circuits!="30d" 
| regex circuits!="total" 
| timechart span=1w last(num) by designs

[cpramuk]

Thank you!!...I was missing the "search 7d" in all of my trials....

[bowesmana · Accepted solution]

Not clear what your expected output is, but is this what you are looking for

obs_mnkr="tnkrcad-p-ue1" source="/disk/logtxt/stats.log" 
| multikv noheader=t 
| fields _raw 
| search 7d
| rex "(?<designs>\w+):(?<span>\w+)\s+(?<num>\d+)"
| timechart span=1w last(num) by designs