https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149208#M41709 <P>Hi,sumanth_isac</P> <P>your props.conf</P> <PRE><CODE>[your_sourcetype] REPORT-AutoHeader = AutoHeader-my_sourcetype </CODE></PRE> <P>your transforms.conf</P> <PRE><CODE>[AutoHeader-my_sourcetype] DELIMS = ” ” FIELDS = “field１”,”field２”,”field３”, … </CODE></PRE> <P>For more information, see below link<BR /> <A href="http://splunkblog.vccorp.net/?p=428">http://splunkblog.vccorp.net/?p=428</A></P> Thu, 11 Dec 2014 07:32:46 GMT akanno 2014-12-11T07:32:46Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149207#M41708 <P>Hi I have data as below. </P> <P>9B 85 65 70 20 61 6C 69 76 65 2C 33 30 30 30 30 3C 00 is one pattern </P> <P>9B 85 65 70 20 61 6C 69 76 65 2C 33 30 30 30 30 3C is the other pattern </P> <P>How can i extract the field for this recurring events</P> Thu, 11 Dec 2014 07:21:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149207#M41708 sumanth_isac 2014-12-11T07:21:38Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149208#M41709 <P>Hi,sumanth_isac</P> <P>your props.conf</P> <PRE><CODE>[your_sourcetype] REPORT-AutoHeader = AutoHeader-my_sourcetype </CODE></PRE> <P>your transforms.conf</P> <PRE><CODE>[AutoHeader-my_sourcetype] DELIMS = ” ” FIELDS = “field１”,”field２”,”field３”, … </CODE></PRE> <P>For more information, see below link<BR /> <A href="http://splunkblog.vccorp.net/?p=428">http://splunkblog.vccorp.net/?p=428</A></P> Thu, 11 Dec 2014 07:32:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149208#M41709 akanno 2014-12-11T07:32:46Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149209#M41710 <P>Hi<BR /> write a search with regular expression<BR /> try this one</P> <PRE><CODE>...|rex "(?i)(?P&lt;FIELDNAME&gt;[\d\w\s]+[^ ]+)"|... </CODE></PRE> Thu, 11 Dec 2014 10:54:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149209#M41710 btt 2014-12-11T10:54:18Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149210#M41711 <P>write a search with regular expression<BR /> try this one</P> <PRE><CODE>...|rex "(?i)(?P&lt;FIELDNAME&gt;[\d\w\s]+)"|... </CODE></PRE> Thu, 11 Dec 2014 11:01:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-field-for-the-data-with-spaces/m-p/149210#M41711 btt 2014-12-11T11:01:49Z