Well you don't have to match all the twiddly bits of the entire event, so the rex can be pretty simple. This one seems to work just fine:
| rex "Unique Media Files.value=(?<media_file_count>\d+)"
This will create a field called "media_file_count" on that row, whose value is 6577
To get a little fancier, this looks a little like SCADA data, in that it's a fairly complicated tag or point name, and a simple value. To the extent that you might have a broad hierarchy of such tag names here, you could do something more generic, like so:
| rex "\d+/\d+/\d+ \d+:\d+ \w+ (?<point_name>.+)??.value=(?<point_value>\d+)" | eval {point_name}=point_value
that will actually create a Splunk field called "Media Table Statistics.Unique Media Files", whose value is 6577
So if you were to run this search over all your data, it would actually sort of break out your data nicely.
| rex "\d+/\d+/\d+ \d+:\d+ \w+ (?<point_name>.+)??.value=(?<point_value>\d+)" | eval {point_name}=point_value
The Sideview Process Historian app actually takes data that looks a lot like this, and it automatically carves up that "foo.bar.baz" hierarchy and makes the whole dataset browsable and pivotable. the app is currently in a bit of a decommissioned state while the 2.0 version is being finalized, but feel free to email me if that is indeed SCADA data and your naming scheme is consistent enough that it might enjoy some nice automatic browse/report functionality.
