Splunk Search

Regex Whitespaces delimiter

Observer

Hello,

I have this data which I want to extract to fields :
230.00 36.220 00000111 1 07 103442 07:15 06/01/20 95 ‰† 05 ˆ˜‹€˜™‰ 040000 0005326100352697670 00000001 00050001 6.350 0000000000000000000 2914908 2 00 411 1

I have unknown number of spaces at the beginning and unknown number of spaces in between fields...
can someone help with the regex so I can extract the data in the props.conf file ?
Thanks
Ran

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Observer

Thanks, Did the job 🙂

0 Karma