Archive

How to read White spaces in a Field

New Member

i am trying to count the White space in a Field and extract the rest of the text after 5 white spaces

Input string is :

LTE, VIC, CMFC15_534652, MobEVO P4 PLMN Service Unavailable :
LTE, WA, WCZQ15_591707, MobEVO P6 Heartbeat Failure,

LTE, WA, KRYU15_591689, MobEVO P6 Heartbeat Failure,
LTE, SA, AGQNFU0, MobEVO P6 EnodeB AutoDowntime :

LTE, WA, WOWD15_591276, MobEVO P4 Service Degraded :

Desired Output is :
PLMN Service Unavailable :
Heartbeat Failure,
Heartbeat Failure,
EnodeB AutoDowntime :
Service Degraded :

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"

View solution in original post

0 Karma

New Member

@renjith.nair, i have just posted an other question on how to access all the results for a table, i know that teh token $result.filed$ when used with event handler gives me the very first result on the table but i need all the rows to be accessed

0 Karma

New Member

Thanks a lot, i did figure out eventually

0 Karma