Need help search tablename and count across multiple lines

[Ckashton]

I have data like this in splunk search

2024-10-29 20:14:49 (715) worker.6 worker.6 txid=XXXX JobPersistence Total records archived per table:
sn_vul_vulnerable_item: 1000
sn_vul_detection: 1167
Total records archived: 2167
Total related records archived: 1167

2024-10-29 20:13:17 (337) worker.0 worker.0 txid=YYYY JobPersistence Total records archived per table:
sn_vul_vulnerable_item: 1000
sn_vul_detection: 1066
Total records archived: 2066
Total related records archived: 1066

How can i prepare a table as below ? Basically prepare  a list of tables and sum of their counts between text "Total records archived per table:" and "Total records archived: "

sn_vul_vulnerable_item:2000

sn_vul_detection:2233

This is what i have so far

node=* "Total records archived per table" "Total related records archived:"
| rex field=_raw "Total records archived per table ((?m)[^\r\n]+)(?<tc_table>\S+): (?<tc_archived_count>\d+) Total related records archived:"

[yuanliu]

Is this table what you are looking for?

sn_vul_detection	sn_vul_vulnerable_item
2233	2000

Here is a quick cheat:

| rex mode=sed "s/:\s*(\d+)\n/=\1\n/g"
| extract
| stats sum(sn_vul_*) as sn_vul_*

If you must have that colon-separated notation, add

| foreach *
    [eval notation = mvappend(notation, "<<FIELD>>: " . <<FIELD>>)]

Here is an emulation of your sample data.  Play with it and compare with real data

| makeresults
| eval data = mvappend("2024-10-29 20:14:49 (715) worker.6 worker.6 txid=XXXX JobPersistence Total records archived per table:
sn_vul_vulnerable_item: 1000
sn_vul_detection: 1167
Total records archived: 2167
Total related records archived: 1167",
"2024-10-29 20:13:17 (337) worker.0 worker.0 txid=YYYY JobPersistence Total records archived per table:
sn_vul_vulnerable_item: 1000
sn_vul_detection: 1066
Total records archived: 2066
Total related records archived: 1066")
| mvexpand data
| rename data as _raw
| eval _time = strptime(replace(_raw, "^(\S+ \S+).*", "\1"), "%F %T")
``` data emulation above ```