How to extract spaced delimited field with values containing spaces?

[jesses]

I have a space delimited field that may contain quoted values that also include spaces. For example:

Value1 Value2 Value3 Value4 "Value with a space 5" Value6

I think I need to use makemv, however this just nets me a exactly what you would expect:

| makeresults
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6"
| makemv temp
| fields - _time
Value1
Value2
Value3
Value4
"Value
with
a
space
5"
Value6

This leads me to think that I need a regex to parse it correctly, however I am no regex master. Anybody have any ideas?
Thanks!

[vnravikumar · Accepted solution]

Hi

Try this

| makeresults 
| eval temp="Value1 Value2 Value3 Value4 \"Value with a space 5\" Value6" 
| rex field=temp max_match=0 "(?P<temp>\"[^\"]*\"|[\S]+)+" 
| mvexpand temp 
| eval temp = replace(temp,"\"","") 
| mvcombine temp 
| table temp

[jesses]

I've implemented this into my query and it is working perfectly! Thanks!

[tiagofbmm]

Can you explain what you're looking to get out of that ?

[jesses]

I knew I forgot something.
The field temp should be a mv field containing the follwing:

Value1
Value2
Value3
Value4
Value with a space 5
Value6