I’m going to presume you have no field extractions yet built (except for message) for the sample data you provided, and that – as provided – it’s in the correct format (though, since it seems to be missing timestamps, I can tell something is likely amiss)
This should get you down the right road:
index=ndx sourcetype=srctp message=*
| rex field=message "Passed (?<passed_attempt>\w+)"
| rex field=message "Failed (?<failed_attempt>\w+)"
| rex field=message "case num (?<case_num>\S+)"
| rex field=message "(?<saved>Not saved)"
| rex field=message "(?<saved>Saved)"
| rex field=message "UserId - (?<userid>\w+)"
| rex field=message "XV - (?<xv>\w+)"
| rex field=message "UserAd - (?<userad>\w+)"
| rex field=message "Elect - (?<elect>\w+)"
| rex field=message "Later Code - (?<later_code>\w+)"
| fields passed_attempt failed_attempt _time case_num xv userid elect later_code saved userad
| stats max(_time) as _time values(*) as * by userid case_num
I’ve used separate regular expressions to pull the fields because they’re easier to read – they may (or may not) be more performant to combine.
from User warren – Stack Overflow https://stackoverflow.com/questions/70996279/how-to-write-splunk-query-to-create-a-dashboard/71036381#71036381
via IFTTT