trouble with regex

[nicolay_koecher]

Hello
I have sone trouble with regex
I want build a table or a chart wirh the following content:

I started with this regex command:
^(?:[^ \n]* ){5}(?P<prn_upd>\w+\s+\w+)
2015-04-25 15:07:17.273 Total number of printers deleted: 2
but this shows only the text printers deleted not the quantity - can anybody help me in this?

lastly the table should look like this:

Date Printer created quantity
date Printer deletet quantity
date printers obsoleted
date printers updated
date errors

this is the origin logfile:
2015-04-25 11:07:30.008 Total number of printers created: 0
2015-04-25 11:07:30.008 Total number of printers deleted: 2
2015-04-25 11:07:30.008 Total number of printers obsoleted: 0
2015-04-25 11:07:30.008 Total number of printers updated: 0
2015-04-25 11:07:30.008 Total number of printers with errors: 0

[richgalloway]

Try this. The format will be a little different from what you asked for, but it should get you started.

... | rex "printers (?P<prn_upd>[^:]*):\s*(?P<quantity>\d+)" | stats sum(quantity) as Sum by _time prn_upd | table _time prn_upd Sum`

[dmaislin_splunk]

Here is a quick REGEX: https://regex101.com/r/aK7iQ7/5 It could probably be improved.