Nested Field Extraction

[dahlberg]

I'm working with following REGEX and event lines:

https://regex101.com/r/YsuMHk/1

I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "calling_num" value and the dialed_num value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction?

Thanks,
Mike

[somesoni2]

You could use ltrim function of eval to trim leading spaces.

https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/TextFunctions#ltrim.28X.2CY.29

[dahlberg]

Ok, but I was kinda hoping to trim the leading spaces before I dealt with it in the Search App.

Mike

[somesoni2]

I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-tim...