Yup, it was a character. The rex pulls fields out of a 4000 field wide fixed width line of text and is an enormous mess. I had to write a script to take the fixed width definition and write the rex command. It is about 3 screens tall in the query window in splunk. TRIM worked, now getting exactly what I want, I should have some up with that, and thought the convert to number would handle that, apparently not! Thanks !
... View more