Splunk Search

Regex Help to extract fields

Harikiranjammul
Explorer

Can some one please help with the regex that can be used to view the below event in tabular format.

Event

INFO > 2024-02-02 16:12:12,222 - [application logs message]:

==============================================

Part 1.    session start is completed

Part 2.     Before app message row count    : 9000000

                  Before app consolidation row count    :8888800

Part 3.     append message completed

Part 4.     After app message flush row count : 0

                   After app message flush row count     :1000000

=================================================

 

How can we use regex and get the fields from above event and show them in table like below

parts                   message                                                  count

Part 1               session start is completed

part 2                 Before app message row count          9000000

                                                                                                        8888800

part 3                   append message completed

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Before I invest too much time working on a regex, please can you share your events in a code block </>. Also, do your events really have "Part" in them? (Regex matches in patterns and unless the patterns are accurate, the match will not be found.)

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...