This script may take a while to run, especially on a busy podmaster. Generating Syslog TopN list on node for last 3 hours. Top 5 hosts for Day: Oct8 between 02:
Change your regex to the below if the input contains the exact string you posted.
(?s)\s+1+\s+([\d]+).*?\s+1+\s+([\d]+).*?\s+1+\s+([\d]+)
DEMO
For javascript,
\s+1+\s+([\d]+)[\S\s]*?\s+1+\s+([\d]+)[\S\s]*?\s+1+\s+([\d]+)