All of the fields ending in _1 need to be reported together, then all those ending in _2, etc. The number of suffixed metrics varies from event to event so it will need to be processed like an array until end of event is reached. Can you help?
your base search | extract pairdelim="\n" kvdelim=":" | eval time=strptime(StartDate."T".StartTime, "%Y-%m-%dT%H:%M") | rex max_match=0 field=_raw "Nodename_\d+:\s+(?<nodename>\w+)" | rex max_match=0 field=_raw "Nodetype_\d+:\s+(?<nodetype>\w+)" | rex max_match=0 field=_raw "Msgs_\d+:\s+(?<msgs>\w+)" | rex max_match=0 field=_raw "CPU_\d+:\s+(?<cpu>\w+)" | eval z=mvzip(nodename, mvzip(nodetype, mvzip(msgs, cpu))) | mvexpand z | bin span=15m time | stats sum(msgs) as Msgs sum(cpu) as CPU by time nodename nodetype