Splunk Search

Regex Help to extract fields

Harikiranjammul
Explorer

Can some one please help with the regex that can be used to view the below event in tabular format.

Event

INFO > 2024-02-02 16:12:12,222 - [application logs message]:

==============================================

Part 1.    session start is completed

Part 2.     Before app message row count    : 9000000

                  Before app consolidation row count    :8888800

Part 3.     append message completed

Part 4.     After app message flush row count : 0

                   After app message flush row count     :1000000

=================================================

 

How can we use regex and get the fields from above event and show them in table like below

parts                   message                                                  count

Part 1               session start is completed

part 2                 Before app message row count          9000000

                                                                                                        8888800

part 3                   append message completed

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Before I invest too much time working on a regex, please can you share your events in a code block </>. Also, do your events really have "Part" in them? (Regex matches in patterns and unless the patterns are accurate, the match will not be found.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...