https://community.splunk.com/t5/Getting-Data-In/How-to-change-DELIMS-in-transforms-conf-to-use-multiple-white/m-p/212367#M41768 <P>Hi DeronJensen,</P> <P>I tested DELIMS with <CODE>\s+</CODE> and confirmed it will not work. You'd need to use REGEX instead to use <CODE>\s+</CODE> notation but then FIELDS will not work. A simpler way would be to normalise the incoming data so that multi-whitespaces become one. You can easily do this using the SEDCMD in props.conf. In this case the following should work,</P> <PRE><CODE>[my_sourectype] ... SEDCMD-single-whitepace = s/\s\s*/ /g </CODE></PRE> <P>This will only work on new data. Hope this helps.</P> Wed, 04 Nov 2015 03:30:47 GMT gcato 2015-11-04T03:30:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-DELIMS-in-transforms-conf-to-use-multiple-white/m-p/212366#M41767 <P>We have a system that sends logs with extra white space, causing everything to be off by 1. When the day of month changes from 1 digit to 2 digits, the proxy device sends the log with:</P> <P>The first example has 2 spaces: <CODE>Nov 3</CODE> and the second has 1 space: <CODE>Oct 31</CODE>. When there are 2 spaces between the month and day, all of the fields are off by one. </P> <PRE><CODE>Nov 3 16:27:47 10.1.126.214.100 2015-11-03 16:27:47 15 10.2.172.212 404 ... Oct 31 23:59:59 10.1.126.99.100 2015-10-31 23:59:59 227 10.2.189.178 407 ... </CODE></PRE> <P>My transforms.conf is as follows:</P> <PRE><CODE>DELIMS = " " FIELDS = month,date,time,dvc,date1,time-taken,duration,src,status,... </CODE></PRE> <P>I was thinking about changing to a REGEX, but this seems to be a little more trouble. Is there an easy way to do this? I would like to do: <CODE>DELIMS = "\s+"</CODE> or possibly do something to say "skip empty values". I do not know if this is possible, or is there a simple REGEX that will work?</P> Tue, 03 Nov 2015 16:41:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-DELIMS-in-transforms-conf-to-use-multiple-white/m-p/212366#M41767 DeronJensen 2015-11-03T16:41:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-DELIMS-in-transforms-conf-to-use-multiple-white/m-p/212367#M41768 <P>Hi DeronJensen,</P> <P>I tested DELIMS with <CODE>\s+</CODE> and confirmed it will not work. You'd need to use REGEX instead to use <CODE>\s+</CODE> notation but then FIELDS will not work. A simpler way would be to normalise the incoming data so that multi-whitespaces become one. You can easily do this using the SEDCMD in props.conf. In this case the following should work,</P> <PRE><CODE>[my_sourectype] ... SEDCMD-single-whitepace = s/\s\s*/ /g </CODE></PRE> <P>This will only work on new data. Hope this helps.</P> Wed, 04 Nov 2015 03:30:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-DELIMS-in-transforms-conf-to-use-multiple-white/m-p/212367#M41768 gcato 2015-11-04T03:30:47Z