https://community.splunk.com/t5/Getting-Data-In/How-to-specify-DELIMS-where-to-start-from/m-p/519301#M87822 <P>Hi,</P><P>Is there any way to specify a start point when using DELIMS for field extraction?</P><P>An example, the log looks like this:</P><P>Sep 13 Some Variable Format String: value1 value2 value3 value4 value5...</P><P>I want to extract the "valueX" using a space delimiter. But the beginning of the log has a section with variable number of spaces, which would break the order of fields.</P><P>Is there any way to specify where the DELIMS extraction should start from? Other than having to extract in a new field the list of values&nbsp;with regex (value1 value2 value3 value4 value5...), then use DELIMS on the new field, and at the end set the new field to null()?</P><P>Thank you.</P> Sun, 13 Sep 2020 14:23:35 GMT hoytn 2020-09-13T14:23:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-specify-DELIMS-where-to-start-from/m-p/519301#M87822 <P>Hi,</P><P>Is there any way to specify a start point when using DELIMS for field extraction?</P><P>An example, the log looks like this:</P><P>Sep 13 Some Variable Format String: value1 value2 value3 value4 value5...</P><P>I want to extract the "valueX" using a space delimiter. But the beginning of the log has a section with variable number of spaces, which would break the order of fields.</P><P>Is there any way to specify where the DELIMS extraction should start from? Other than having to extract in a new field the list of values&nbsp;with regex (value1 value2 value3 value4 value5...), then use DELIMS on the new field, and at the end set the new field to null()?</P><P>Thank you.</P> Sun, 13 Sep 2020 14:23:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-specify-DELIMS-where-to-start-from/m-p/519301#M87822 hoytn 2020-09-13T14:23:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-specify-DELIMS-where-to-start-from/m-p/519311#M87823 <P><SPAN>field1=Sep field2=213 field3=Some field4=Variable field5=Format field6=String: field7=value1 value2 value3 value4 value5.</SPAN></P><P><SPAN>so your value will start from field7. you should give field name starting from event. there is no way to define start fields from value.</SPAN></P> Sun, 13 Sep 2020 15:49:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-specify-DELIMS-where-to-start-from/m-p/519311#M87823 thambisetty 2020-09-13T15:49:49Z