Splunk Search

Parsing Results with spaces

jaydiare
Explorer

I have this output from a field, with a lot of blank spaces,  what would it be the best way to convert this data into a table? or maybe a regex to parse it out better

Start

TREATMENTING ROUTES. TREATMENTS IS: GNCT
 
1 T12023
 
2 LKOUTWDF
 
POSITIONS ROUTES. POSITIONS IS: TOPS
 
1 CGHBRAB21053TBX
 
N S3T55NS
 
End.
Labels (2)
0 Karma

jaydiare
Explorer

jaydiare_0-1638467123914.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

From this event, what would you like to see in the table?

0 Karma

jaydiare
Explorer

no spaces from the top or the bottom 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/(?ms)^\s+$\n?//g"
0 Karma

jaydiare
Explorer

Start and End are not part of the output  🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What about how the table should look and other (sample) events?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I assume this field is from one event? Does it include the "Start" and "End."? What would you like to see in the table? Can you share other events or are they all like this i.e. same number of lines, same headings, etc.?

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...