How to match with rex if pattern can contain optional white spaces?

[ctsurumaki]

I have a search query where the "# of Transactions Processed:" string sometimes contains one or more whitespaces before the numeric value but sometimes no whitespace

The below works fine for this example message 

| search message="# of Transactions Processed:51" 

| rex field=message "Processed:(?<ProcessedCount>\d+)"

But if the message has a space after the colon and before the number, then it doesn't match unless I add a space after the colon:

| search message="# of Transactions Processed: 51" 

| rex field=message "Processed: (?<ProcessedCount>\d+)"

Been struggling to find a good solution to this and was wondering if any of you Splunkers had figured this out previously 🙂   I could add another |rex with the second option but was hoping there was a more elegant and efficient way to accomplish it.

many thanks in advance !

[yeahnah · Accepted solution]

Hi @ctsurumaki

try this...

| rex field=message "Processed:\s*(?<ProcessedCount>\d+)"

The \s* will match zero or more whitespaces.

Hope that helps