How to extract information from my sample log file?

[lctanlc]

I am new to Splunk but am given a tight deadline to explore the possibility of using Splunk to extract information from a log file that consists of the following 3 typical lines:

2015-05-01 07:33 - [User Login] | Name#ID | 'John#11' | :User name: 'John', ID: '11' successfully logged in
2015-05-02 17:07 - [Search] | Name#ID | 'Sue#222' | :Estimated time | '2,06ms' |, Result count | '23' |, Search Terms | '{"Type":"ALL","Tag":[],"sn":"","searchEndDate":null,"Query":"storm","searchStartDate":1428249600000}' |
2015-05-03 09:18 - [Edit] | Name#ID | 'Tom#3333' | :Announcement 'Maintenance' updated successfully.

May I know how I can construct the Splunk query statement to extract the Action (ie, User Login, Search, Edit), User Name (ie, John, Sue, Tom), ID (ie, 11, 222, 3333), Search Time Taken (ie, 2,06ms), Search Count (ie, 23) and Search Terms (ie, {"Type":"ALL","Tag":[],"sn":"","searchEndDate":null,"Query":"storm","searchStartDate":1428249600000})?

[woodcock · Accepted solution]

Try this:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID \| '(?<UserName>[^#]*)#(?<ID>[^']*)" | rex ".*Estimated time \| '(?<SearchTimeTaken>[^']*)' \|, Result count \| '(?<SearchCount>\d+)' \|, Search Terms \| '\{(?<SearchTerms>[^\}]*)\}'"

[lctanlc]

Thanks a lot! It works!