Getting Data In

Keep whitespace at beginning of a field value


Splunk truncates leading and trailing spaces during field extraction. Normally this is desired behavior.
However, for one of our fields, the leading spaces must be preserved. It is about a fileinput with KV_MODE = none.
This should also not involve any manipulation of the field value, such as inserting quotes at the beginning and end of the field value, which would preserve the spaces.
Any ideas are welcome - is it possible at all?

Labels (3)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>