Splunk Search

Regex Whitespaces delimiter

ranmys
Loves-to-Learn

Hello,

I have this data which I want to extract to fields :
230.00 36.220 00000111 1 07 103442 07:15 06/01/20 95 ‰† 05 ˆ˜‹€˜™‰ 040000 0005326100352697670 00000001 00050001 6.350 0000000000000000000 2914908 2 00 411 1

I have unknown number of spaces at the beginning and unknown number of spaces in between fields...
can someone help with the regex so I can extract the data in the props.conf file ?
Thanks
Ran

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, Karma would be appreciated.
0 Karma

ranmys
Loves-to-Learn

Thanks, Did the job 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...