topic Re: Parsing Results with spaces in Splunk Search

Parsing Results with spaces

jaydiare — Thu, 02 Dec 2021 15:00:45 GMT

I have this output from a field, with a lot of blank spaces, what would it be the best way to convert this data into a table? or maybe a regex to parse it out better

Start

TREATMENTING ROUTES. TREATMENTS IS: GNCT

1 T12023

2 LKOUTWDF

POSITIONS ROUTES. POSITIONS IS: TOPS

1 CGHBRAB21053TBX

N S3T55NS

End.

Re: Parsing Results with spaces

ITWhisperer — Thu, 02 Dec 2021 16:01:19 GMT

I assume this field is from one event? Does it include the "Start" and "End."? What would you like to see in the table? Can you share other events or are they all like this i.e. same number of lines, same headings, etc.?

Re: Parsing Results with spaces

jaydiare — Thu, 02 Dec 2021 16:51:23 GMT

Start and End are not part of the output 🙂

Re: Parsing Results with spaces

ITWhisperer — Thu, 02 Dec 2021 17:35:09 GMT

What about how the table should look and other (sample) events?

Re: Parsing Results with spaces

jaydiare — Thu, 02 Dec 2021 17:45:33 GMT

Re: Parsing Results with spaces

ITWhisperer — Thu, 02 Dec 2021 17:55:00 GMT

From this event, what would you like to see in the table?

Re: Parsing Results with spaces

jaydiare — Thu, 02 Dec 2021 18:33:30 GMT

no spaces from the top or the bottom

Re: Parsing Results with spaces

ITWhisperer — Thu, 02 Dec 2021 18:54:47 GMT

| rex mode=sed "s/(?ms)^\s+$\n?//g"