Splunk Search

Nested Field Extraction

dahlberg
New Member

I'm working with following REGEX and event lines:

https://regex101.com/r/YsuMHk/1

I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "calling_num" value and the dialed_num value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction?

Thanks,
Mike

Tags (2)
0 Karma

somesoni2
Revered Legend
0 Karma

dahlberg
New Member

Ok, but I was kinda hoping to trim the leading spaces before I dealt with it in the Search App.

Mike

0 Karma

somesoni2
Revered Legend

I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-tim...

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...