Splunk Search

Nested Field Extraction

dahlberg
New Member

I'm working with following REGEX and event lines:

https://regex101.com/r/YsuMHk/1

I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "calling_num" value and the dialed_num value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction?

Thanks,
Mike

Tags (2)
0 Karma

somesoni2
Revered Legend
0 Karma

dahlberg
New Member

Ok, but I was kinda hoping to trim the leading spaces before I dealt with it in the Search App.

Mike

0 Karma

somesoni2
Revered Legend

I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-tim...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...