https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473093#M133165 <P>Indicate the leading spaces with <CODE>\s*</CODE> and the intervening spaces with <CODE>\s+</CODE>. The full regex would look something like <CODE>\s*(\S+)\s+(\S+)\s+...</CODE>.</P> Mon, 17 Feb 2020 13:27:45 GMT richgalloway 2020-02-17T13:27:45Z https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473092#M133164 <P>Hello,</P> <P>I have this data which I want to extract to fields :<BR /> 230.00 36.220 00000111 1 07 103442 07:15 06/01/20 95 &#143;‰†&#144;&#129; 05 ˆ˜‹€˜™‰ 040000 0005326100352697670 00000001 00050001 6.350 0000000000000000000 2914908 2 00 411 1</P> <P>I have unknown number of spaces at the beginning and unknown number of spaces in between fields...<BR /> can someone help with the regex so I can extract the data in the props.conf file ?<BR /> Thanks<BR /> Ran</P> Mon, 17 Feb 2020 11:36:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473092#M133164 ranmys 2020-02-17T11:36:05Z https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473093#M133165 <P>Indicate the leading spaces with <CODE>\s*</CODE> and the intervening spaces with <CODE>\s+</CODE>. The full regex would look something like <CODE>\s*(\S+)\s+(\S+)\s+...</CODE>.</P> Mon, 17 Feb 2020 13:27:45 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473093#M133165 richgalloway 2020-02-17T13:27:45Z https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473094#M133166 <P>Thanks, Did the job <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 18 Feb 2020 14:49:40 GMT https://community.splunk.com/t5/Splunk-Search/Regex-Whitespaces-delimiter/m-p/473094#M133166 ranmys 2020-02-18T14:49:40Z