Splunk Search

How to extract spaced delimited field with values containing spaces?

New Member

I have a space delimited field that may contain quoted values that also include spaces. For example:

Value1 Value2 Value3 Value4 "Value with a space 5" Value6

I think I need to use makemv, however this just nets me a exactly what you would expect:

| makeresults
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6"
| makemv temp
| fields - _time
Value1
Value2
Value3
Value4
"Value
with
a
space
5"
Value6

This leads me to think that I need a regex to parse it correctly, however I am no regex master. Anybody have any ideas?
Thanks!

0 Karma
1 Solution

Champion

Hi

Try this

| makeresults 
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6" 
| rex field=temp max_match=0 "(?P<temp>\"[^\"]*\"|[\S]+)+" 
| mvexpand temp 
| eval temp = replace(temp,"\"","") 
| mvcombine temp 
| table temp

View solution in original post

0 Karma

Champion

Hi

Try this

| makeresults 
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6" 
| rex field=temp max_match=0 "(?P<temp>\"[^\"]*\"|[\S]+)+" 
| mvexpand temp 
| eval temp = replace(temp,"\"","") 
| mvcombine temp 
| table temp

View solution in original post

0 Karma

New Member

I've implemented this into my query and it is working perfectly! Thanks!

0 Karma

Influencer

Can you explain what you're looking to get out of that ?

0 Karma

New Member

I knew I forgot something.
The field temp should be a mv field containing the follwing:

Value1
Value2
Value3
Value4
Value with a space 5
Value6
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!