Splunk Search

How to read White spaces in a Field

hyn
New Member

i am trying to count the White space in a Field and extract the rest of the text after 5 white spaces

Input string is :

LTE, VIC, CMFC15_534652, MobEVO P4 PLMN Service Unavailable :
LTE, WA, WCZQ15_591707, MobEVO P6 Heartbeat Failure,

LTE, WA, KRYU15_591689, MobEVO P6 Heartbeat Failure,
LTE, SA, AGQNFU0, MobEVO P6 EnodeB AutoDowntime :

LTE, WA, WOWD15_591276, MobEVO P4 Service Degraded :

Desired Output is :
PLMN Service Unavailable :
Heartbeat Failure,
Heartbeat Failure,
EnodeB AutoDowntime :
Service Degraded :

0 Karma
1 Solution

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@hyn,

Try

   rex field="your input string"  "\S+(\s+\S+){4}\s+(?<OUTPUT>.+)"
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

hyn
New Member

@renjith.nair, i have just posted an other question on how to access all the results for a table, i know that teh token $result.filed$ when used with event handler gives me the very first result on the table but i need all the rows to be accessed

0 Karma

hyn
New Member

Thanks a lot, i did figure out eventually

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...