How to extract field for the data with spaces

[sumanth_isac]

Hi I have data as below.

9B 85 65 70 20 61 6C 69 76 65 2C 33 30 30 30 30 3C 00 is one pattern

9B 85 65 70 20 61 6C 69 76 65 2C 33 30 30 30 30 3C is the other pattern

How can i extract the field for this recurring events

[btt]

write a search with regular expression
try this one

...|rex "(?i)(?P<FIELDNAME>[\d\w\s]+)"|...

[btt]

Hi
write a search with regular expression
try this one

...|rex "(?i)(?P<FIELDNAME>[\d\w\s]+[^ ]+)"|...

[akanno]

Hi,sumanth_isac

your props.conf

[your_sourcetype]
REPORT-AutoHeader = AutoHeader-my_sourcetype

your transforms.conf

[AutoHeader-my_sourcetype]
DELIMS = ” ”
FIELDS = “field１”,”field２”,”field３”, …

For more information, see below link
http://splunkblog.vccorp.net/?p=428