Ok, after a bit of trial and error, I was able to solve this.
However, I am not sure if it's an efficient way. I'm hoping splunk experts on this group weigh in on the solution.
... | rex field=_raw "Error/type/(?\d+)\s*:\s*(?\S+)" max_match=100
| rex field=_raw "Error/desc/\d+\s*:\s*(?\S+)" max_match=100
| rex field=_raw "Error/logfile/\d+\s*:\s*(?\S+)" max_match=100
| eval fields = mvzip(mvzip(mvzip(num,type_value),desc_value),log_value)
| mvexpand fields
| rex field=fields "(?\S+),(?\S+),(?\S+),(?\S+)"
| table _time num type desc logfile
... View more