How to write the regex to extract added, removed, and changed files/directories and list them?

[gantonio]

How can i extract the added, removed, and changed file/directory and list them to a field respectively using regular expressions?
Below is the sample Splunk event.

Start timestamp: 2016-06-02 05:00:01
Summary:
Total number of files: 76478
Added files: 4
Removed files: 3
Changed files: 3

Added files:
added: /test/dir1/dir2
added: /sample/dir/test
added: /testing/splunk/test
added: /application/test/splunk

Removed files:
removed: /removed/files
removed: /test/removing/files
removed: /sample.txt

Changed files:
changed: /changed/files/sample.txt
changed: /test/app.conf
changed: /app/local.meta

[javiergn · Accepted solution]

Is this what you are looking for?
You can obviously ignore the first 3 lines that I used to reproduce your use case:

| stats count
| fields - count
| eval _raw = "
Start timestamp: 2016-06-02 05:00:01
Summary:
Total number of files: 76478
Added files: 4
Removed files: 3
Changed files: 3

Added files:
added: /test/dir1/dir2
added: /sample/dir/test
added: /testing/splunk/test
added: /application/test/splunk

Removed files:
removed: /removed/files
removed: /test/removing/files
removed: /sample.txt

Changed files:
changed: /changed/files/sample.txt
changed: /test/app.conf
changed: /app/local.meta
"
| rex field=_raw max_match=0 "added: (?<added>[^\n]+)"
| rex field=_raw max_match=0 "removed: (?<removed>[^\n]+)"
| rex field=_raw max_match=0 "changed: (?<changed>[^\n]+)"

Output (see picture):