Splunk truncates leading and trailing spaces during field extraction. Normally this is desired behavior.
However, for one of our fields, the leading spaces must be preserved. It is about a fileinput with KV_MODE = none.
This should also not involve any manipulation of the field value, such as inserting quotes at the beginning and end of the field value, which would preserve the spaces.
Any ideas are welcome - is it possible at all?
I'm looking for this myself. Have a very old format that I need to keep the spaces for proper field extractions in props. Have you found any setting that can be changed in props and/or transforms?