How to edit my regex to extract the type and message fields for the exception information from WinEventLog:Application?

[chrisduimstra]

I am trying to extract the type and message field for the exception information in the application logs. I have abstracted the logs because they are quite long. The logs can have between 1 to 3 Exception Information groups, and I need the type and message field from each one. I have tried the following regex in my props file without success. These have been tested and worked on https://regex101.com/#pcre. The first one works, but the second and third are not working.

EXTRACT-exception_message1 = \bType: \b.*?\n\bMessage: \b(?P<exception_message>.*?)\n
EXTRACT-exception_message2 = 2\)(?:.*\n){3}\bMessage: \b(?P<exception_message>.*?)\n
EXTRACT-exception_message3 = 3\)(?:.*\n){3}\bMessage: \b(?P<exception_message>.*?)\n

I have also tried extracting to separate fields by naming the fields.

<exception_message1>
<exception_message2>
<exception_message3>

While the type field will be useful, my priority is to get the message field extracting properly.
Here is an example of a log.

somefields=value

General Information
*********************************************
morefields=morevalues

1) Exception Information
*********************************************
Type=value
Message=value
otherfields=values

Stack Trace Information
*********************************************
   stacktraceinfo

2) Exception Information
*********************************************
Type=value
Message=value
otherfields=values

Stack Trace Information
*********************************************
   stacktraceinfo

[somesoni2 · Accepted solution]

I believe you're looking to extract Type and message as multivalued field extraction, so you would use a props-transform for that.

See this

https://answers.splunk.com/answers/112311/multi-value-field-extraction.html
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Createandmaintainsearch-timefieldextract...

Another method will be use fields.conf
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

[chrisduimstra]

This pointed me in the right direction, thanks.