Splunk Search

How to read White spaces in a Field

hyn
New Member

i am trying to count the White space in a Field and extract the rest of the text after 5 white spaces

Input string is :

LTE, VIC, CMFC15_534652, MobEVO P4 PLMN Service Unavailable :
LTE, WA, WCZQ15_591707, MobEVO P6 Heartbeat Failure,

LTE, WA, KRYU15_591689, MobEVO P6 Heartbeat Failure,
LTE, SA, AGQNFU0, MobEVO P6 EnodeB AutoDowntime :

LTE, WA, WOWD15_591276, MobEVO P4 Service Degraded :

Desired Output is :
PLMN Service Unavailable :
Heartbeat Failure,
Heartbeat Failure,
EnodeB AutoDowntime :
Service Degraded :

0 Karma
1 Solution

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

hyn
New Member

@renjith.nair, i have just posted an other question on how to access all the results for a table, i know that teh token $result.filed$ when used with event handler gives me the very first result on the table but i need all the rows to be accessed

0 Karma

hyn
New Member

Thanks a lot, i did figure out eventually

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...