Splunk Search

How to read White spaces in a Field

hyn
New Member

i am trying to count the White space in a Field and extract the rest of the text after 5 white spaces

Input string is :

LTE, VIC, CMFC15_534652, MobEVO P4 PLMN Service Unavailable :
LTE, WA, WCZQ15_591707, MobEVO P6 Heartbeat Failure,

LTE, WA, KRYU15_591689, MobEVO P6 Heartbeat Failure,
LTE, SA, AGQNFU0, MobEVO P6 EnodeB AutoDowntime :

LTE, WA, WOWD15_591276, MobEVO P4 Service Degraded :

Desired Output is :
PLMN Service Unavailable :
Heartbeat Failure,
Heartbeat Failure,
EnodeB AutoDowntime :
Service Degraded :

0 Karma
1 Solution

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
Happy Splunking!
0 Karma

hyn
New Member

@renjith.nair, i have just posted an other question on how to access all the results for a table, i know that teh token $result.filed$ when used with event handler gives me the very first result on the table but i need all the rows to be accessed

0 Karma

hyn
New Member

Thanks a lot, i did figure out eventually

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...