Splunk: How to extract a field containing spaces at end

Question

I try to extract the value of a field that contains spaces. Apparently it is hard to find a regular expression for this case (even the question is if it is possible at all).

Example: 03 Container ID - ALL_ELIGIBLE_STG_RTAIN Offer Set ID

From Above example, we have to get the count Container ID - ALL_ELIGIBLE_STG_RTAIN

I am Expecting like this.

Container ID	Count
ALL_ELIGIBLE_STG_RTAIN	xxxx

Is `Container ID - ` string present in all events that your are interested in? — PM 77-1, Nov 09 '22 at 19:29

score 1 · Answer 1 · answered Nov 10 '22 at 00:35

1

Assuming all container IDs are preceded by "Container ID - " then this command will extract them.

| rex "Container ID - (?<ContainerID>\S+)"

answered Nov 10 '22 at 00:35

RichG

9,063
2
18
29

Splunk: How to extract a field containing spaces at end

1 Answers1