Splunk doesn't preserve indentation line spaces in KV Store

[kiril123]

I am uploading data to KV Store in the following format with spaces at the beginning of each line:

AAAAA
\s\sBBBBB
\s\s\s\sCCCCC

However after the data is uploaded and then running a lookup search the data is displayed without indentation spaces:

AAAAA
BBBBB
CCCCC

Is it possible to change this behaviour?

[valiquet]

\s is for regex only.

Try quotes:

"AAAAA"
"  BBBBB"
"    CCCCC"

[kiril123]

I have tried quotes as well - still not spaces at the beginning of the lines after the data is loaded to kv store. Looks like splunk strips them by default...

[p_gurav]

Hi,

Can you tell, why you want to preserve space?

[kiril123]

Hello,

Indentation spaces have a very important role in network device configurations (e.g. Cisco). They define a parent-child relationship between configuration lines.

[valiquet]

\s is for regex only.

Try quotes:

"AAAAA"
" BBBBB"
" CCCCC"