topic Re: How to read White spaces in a Field in Splunk Search

How to read White spaces in a Field

hyn — Wed, 30 Sep 2020 01:12:52 GMT

i am trying to count the White space in a Field and extract the rest of the text after 5 white spaces

Input string is :

LTE, VIC, CMFC15_534652, MobEVO P4 PLMN Service Unavailable :
LTE, WA, WCZQ15_591707, MobEVO P6 Heartbeat Failure,

LTE, WA, KRYU15_591689, MobEVO P6 Heartbeat Failure,
LTE, SA, AGQNFU0, MobEVO P6 EnodeB AutoDowntime :

LTE, WA, WOWD15_591276, MobEVO P4 Service Degraded :

Desired Output is :
PLMN Service Unavailable :
Heartbeat Failure,
Heartbeat Failure,
EnodeB AutoDowntime :
Service Degraded :

Re: How to read White spaces in a Field

renjith_nair — Thu, 11 Jul 2019 14:10:09 GMT

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"

Re: How to read White spaces in a Field

hyn — Fri, 10 Jan 2020 00:25:35 GMT

Thanks a lot, i did figure out eventually

Re: How to read White spaces in a Field

hyn — Fri, 10 Jan 2020 00:27:40 GMT

@renjith.nair, i have just posted an other question on how to access all the results for a table, i know that teh token $result.filed$ when used with event handler gives me the very first result on the table but i need all the rows to be accessed