Splunk Search
Highlighted

Nested Field Extraction

New Member

I'm working with following REGEX and event lines:

https://regex101.com/r/YsuMHk/1

I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "callingnum" value and the dialednum value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction?

Thanks,
Mike

Tags (2)
0 Karma
Highlighted

Re: Nested Field Extraction

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Nested Field Extraction

New Member

Ok, but I was kinda hoping to trim the leading spaces before I dealt with it in the Search App.

Mike

0 Karma
Highlighted

Re: Nested Field Extraction

SplunkTrust
SplunkTrust

I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search.
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-tim...

0 Karma