Knowledge Management

Splunk doesn't preserve indentation line spaces in KV Store

kiril123
Path Finder

I am uploading data to KV Store in the following format with spaces at the beginning of each line:

AAAAA
\s\sBBBBB
\s\s\s\sCCCCC

However after the data is uploaded and then running a lookup search the data is displayed without indentation spaces:

AAAAA
BBBBB
CCCCC

Is it possible to change this behaviour?

0 Karma

valiquet
Contributor

\s is for regex only.

Try quotes:

"AAAAA"
"  BBBBB"
"    CCCCC"
0 Karma

kiril123
Path Finder

I have tried quotes as well - still not spaces at the beginning of the lines after the data is loaded to kv store. Looks like splunk strips them by default...

0 Karma

p_gurav
Champion

Hi,

Can you tell, why you want to preserve space?

0 Karma

kiril123
Path Finder

Hello,

Indentation spaces have a very important role in network device configurations (e.g. Cisco). They define a parent-child relationship between configuration lines.

0 Karma

valiquet
Contributor

\s is for regex only.

Try quotes:

"AAAAA"
" BBBBB"
" CCCCC"

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...