How to achieve this Splunk regex query?

[sbsinha04]

This is the log i am getting in splunk

msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12
Cleanable Process Instance Count {"exception_management_workflow":{"finishedCount":6621,"cleanableCount":1113}}

i want output like

Engine                              finishedProcessInstanceCount

Engine12                              6621

Could you please help me on that, i am trying below query but not working

index=abc cf_app_name="DEV" |rex field=_raw "engine.(?<pam>.........) ,finishedProcessInstanceCount...(?<sam>..\d+)" | table pam, sam

[richgalloway]

The example regex would work great if the engine name was followed immediately by a comma and the finished count, but that's not the case.  While we could define a regex to extract both fields from the event, this is a good example of a time when multiple rex commands is easier to work with.

index=abc cf_app_name="DEV" 
| rex "engine:(?<pam>\w+)"
| rex "finishedCount\\\":(?<sam>\d+)" 
| table pam, sam

[sbsinha04]

Query is not returning any data

[richgalloway]

It works with the sample event provided in the OP.

| makeresults 
| eval _raw="msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12
Cleanable Process Instance Count {\"exception_management_workflow\":{\"finishedCount\":6621,\"cleanableCount\":1113}}"
| rex "engine:(?<pam>\w+)"
| rex "finishedCount\\\":(?<sam>\d+)" 
| table pam, sam

If it's not working with real data then it's possible either or both of the regular expressions need to be modified to match the real data.

[sbsinha04]

It's not working