Solved: Re: Regex Whitespaces delimiter

ranmys · ‎02-17-2020

Hello,

I have this data which I want to extract to fields :
230.00 36.220 00000111 1 07 103442 07:15 06/01/20 95 ‰† 05 ˆ˜‹€˜™‰ 040000 0005326100352697670 00000001 00050001 6.350 0000000000000000000 2914908 2 00 411 1

I have unknown number of spaces at the beginning and unknown number of spaces in between fields...
can someone help with the regex so I can extract the data in the props.conf file ?
Thanks
Ran

richgalloway · ‎02-17-2020

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway · ‎02-17-2020

Indicate the leading spaces with \s* and the intervening spaces with \s+. The full regex would look something like \s*(\S+)\s+(\S+)\s+....

---
If this reply helps you, Karma would be appreciated.

ranmys · ‎02-18-2020

Thanks, Did the job 🙂

Regex Whitespaces delimiter

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation