I'm working with following REGEX and event lines:
https://regex101.com/r/YsuMHk/1
I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "calling_num" value and the dialed_num value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction?
Thanks,
Mike
You could use ltrim function of eval to trim leading spaces.
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/TextFunctions#ltrim.28X.2CY.29
Ok, but I was kinda hoping to trim the leading spaces before I dealt with it in the Search App.
Mike
I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-tim...