Tab separated content parsing - some lines may have some columns with null values

[vynid]

Hi I am having some trouble coming up with a good filter to parse the content field in a tab separated file.

eg , the log content can have lines where some columns are null. 

Assuming the spaces are tabs - first line has all fields with values, second line has null for field3

I tried using a space delimiter in my parse which works ok for lines that have all values, but for those with nulls, it is  picking up the next value ( like field4 for the field3 column ), which makes sense I guess . 

Is there a specific tab delimiter ? I could not seem to find it in the docs for some reason.

My filter looks like this 

 parse content, "LD*:field1 SPACE LD*:field2 SPACE LD*:field3   SPACE LD*:field4  SPACE LD*:field5 

            field1 field2 field3 field4 field5

            field1 field2            field4 field5 

[vynid · Accepted solution]

I think I got it - just replaced SPACE with \t  . 

[RohitBisht]

You can also use "BLANK" as it will take care of space and tab, here is the list of matchers available.
https://docs.dynatrace.com/docs/shortlink/dpl-grammar 

[Peter_Youssef]

Hi @vynid 

PFA resources regarding log DQL parsing :

• https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-query-language/commands/extr...
• https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-query-language/commands
• https://www.youtube.com/watch?v=F2VbVqNlswk

Hoping it helps.

BR,

Peter

[Mohammed-Samy]

you can use optional nspace and space with count

for example 

NSPACE?:f1 SPACE{2} NSPACE?:f2 SPACE{2} NSPACE?:f3 SPACE{2} NSPACE?:f4 SPACE{2} NSPACE?:f5