Splunk Search

Regex Help to extract fields

New Member

Can some one please help with the regex that can be used to view the below event in tabular format.


INFO > 2024-02-02 16:12:12,222 - [application logs message]:


Part 1.    session start is completed

Part 2.     Before app message row count    : 9000000

                  Before app consolidation row count    :8888800

Part 3.     append message completed

Part 4.     After app message flush row count : 0

                   After app message flush row count     :1000000



How can we use regex and get the fields from above event and show them in table like below

parts                   message                                                  count

Part 1               session start is completed

part 2                 Before app message row count          9000000


part 3                   append message completed

Labels (2)
0 Karma


Before I invest too much time working on a regex, please can you share your events in a code block </>. Also, do your events really have "Part" in them? (Regex matches in patterns and unless the patterns are accurate, the match will not be found.)

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...