Distinguish between space and tab - REGEX

[emaccaferri]

Hi!

I'm trying to build a regex to extract n-field in a log. Each field of the log is separated by a tab, but it's possible to find spaces (any kind of string or phrases) inside them, here an example

aaaaa, AD.cr(tab)2000-01-01 00:00:00(tab)12345/678-9(tab)987,654:321(tab)1(tab)2(tab)abcdefg123; asdoi(tab)...

There's a way to distinguish between a tab and a space or \s comprehend also tabs?
Supposing to need 6th field, this doesn't work

([a-zA-Z0-9,/:.-;=]+\s?\t){6}(?<field>[\w-:\s]+)\t

So

`aaaaa, AD.cr` 

or

abcdefg123; asdoi

have to be two field.
Actually I have more than 100 field and I would like to extract 64th.

Thank you

[alacercogitatus · Accepted solution]

If you are certain there are no other tabs in the data, you can use a props/transforms to parse without regex.

props.conf
[my_sourcetype]
REPORT-do = extract_csv_fields_sourcetype


transforms.conf
[extract_csv_fields_sourcetype]
DELIMS = "\t"
FIELDS = field1, field2, field3, ... field100

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf

[alacercogitatus]

You can just put the first 64 in the FIELDS section, it should still pick them up correctly. But it won't really slow it down noticeably by extracting 64 fields. I have many many more fields than that and it works great. I think it's more expensive to use a regex than the FIELDS modifier.

[emaccaferri]

If I use this method I have to extract all the 100 fields, even if I don't nedd them, right?
It would be not so efficient

[Ayn]

\s matches whitespace, which includes both regular spaces and tabs.

[Ayn]

Sure. '\t' for tab, and simply ' ' for space.

[emaccaferri]

Ok thanks, there is a way to match only one of the two?

[emaccaferri]

Usually in the line some field are empty, this means that there are a lot of tab one after the other