Extracting fields

[kunadkat]

What is the most efficient way to extract 3 different search time and 2 different doc count and user and application info?

2012-06-18 21:10:42,387 INFO [STDOUT] INFO - EasyDocSoap.documentSearch(84) | TOTAL SEARCH TIME: 600 ms. FileNet Time: 27 ms. FN Doc Count: 3 OnBase Time: 570 ms. OB Doc Count: 0 for APP2 and User: ABCD

[Takajian]

I think it depends on how you configure regex. Following is just example configuration in props.conf.

[your_sourcetype]
EXTRACT-example_field1 = (?i)TIME:\s(?P\d+)\s+
EXTRACT-example_field2 = (?i)FileNet Time:\s(?P\S+)\s+
EXTRACT-example_field3 = (?i)OnBase Time:\s(?P\S+)\s+