Splunk Search

Regex Help to extract fields

Harikiranjammul
Explorer

Can some one please help with the regex that can be used to view the below event in tabular format.

Event

INFO > 2024-02-02 16:12:12,222 - [application logs message]:

==============================================

Part 1.    session start is completed

Part 2.     Before app message row count    : 9000000

                  Before app consolidation row count    :8888800

Part 3.     append message completed

Part 4.     After app message flush row count : 0

                   After app message flush row count     :1000000

=================================================

 

How can we use regex and get the fields from above event and show them in table like below

parts                   message                                                  count

Part 1               session start is completed

part 2                 Before app message row count          9000000

                                                                                                        8888800

part 3                   append message completed

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Before I invest too much time working on a regex, please can you share your events in a code block </>. Also, do your events really have "Part" in them? (Regex matches in patterns and unless the patterns are accurate, the match will not be found.)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...