How to specify DELIMS where to start from?

[hoytn]

Hi,

Is there any way to specify a start point when using DELIMS for field extraction?

An example, the log looks like this:

Sep 13 Some Variable Format String: value1 value2 value3 value4 value5...

I want to extract the "valueX" using a space delimiter. But the beginning of the log has a section with variable number of spaces, which would break the order of fields.

Is there any way to specify where the DELIMS extraction should start from? Other than having to extract in a new field the list of values with regex (value1 value2 value3 value4 value5...), then use DELIMS on the new field, and at the end set the new field to null()?

Thank you.

[thambisetty]

field1=Sep field2=213 field3=Some field4=Variable field5=Format field6=String: field7=value1 value2 value3 value4 value5.

so your value will start from field7. you should give field name starting from event. there is no way to define start fields from value.