I don't think I know a way to trim the spaces during field extractions regex itself. You're saving the field extractions (in props.conf OR in Settings->Fields->Field extractions), not doing inline in search?? You would be able to created calculated fields where you can do that eval-trim operation. This way your data users will not have to do it in the search. https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Searchtimeoperationssequence#Search-time_operation_sequence ... View more

Hi @dahlberg I Started with this, but If you know the field names maybe you could post them and I'll update my answer, but for now I have just called them a,b,c etc. https://regex101.com/r/a9Tm6c/1 ^(?P<a>[^\s]+)\s+(?P<b>[^\s]+)\s+(?P<c>[^\s]+)\s+(?P<d>[^\s]+)\s+(?P<e>[^\s]+)\s+(?P<f>[^\s]+)?\s+(?P<g>[^\s]+)?\s+(?P<h>[^\s]+)?\s+(?P<i>[^\s]+)\s+(?P<j>[^\s]+)\s+(?P<k>[^\s]+)\s+(?P<l>[^\s]+) Obviously, not all fields may be present in all logs, so you may need to fiddle the the option flag ? ... View more

Hello, This usually happens when there are hidden .swp files created while you are opening the files by an editor. Regards ... View more

Thanks. I used btool and found I wasn't loading that particular props.conf file. ... View more

Go-tourgh this link https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F ... View more