Splunk Search

Regex Help to extract fields

New Member

Can some one please help with the regex that can be used to view the below event in tabular format.


INFO > 2024-02-02 16:12:12,222 - [application logs message]:


Part 1.    session start is completed

Part 2.     Before app message row count    : 9000000

                  Before app consolidation row count    :8888800

Part 3.     append message completed

Part 4.     After app message flush row count : 0

                   After app message flush row count     :1000000



How can we use regex and get the fields from above event and show them in table like below

parts                   message                                                  count

Part 1               session start is completed

part 2                 Before app message row count          9000000


part 3                   append message completed

Labels (2)
0 Karma


Before I invest too much time working on a regex, please can you share your events in a code block </>. Also, do your events really have "Part" in them? (Regex matches in patterns and unless the patterns are accurate, the match will not be found.)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...