topic Re: How to remove Double quotes from a ip field values? in Splunk Dev

How to remove Double quotes from a ip field values?

shivi_tcs — Mon, 05 Jun 2017 09:54:49 GMT

Hello All,

I have a field named src which contains IP's but with double quotes around them.
I want to remove the double quotes from these values.

Example
extracted value src="10.23.25.23"
needed value src=10.23.25.23

dineshraj9 — Mon, 05 Jun 2017 12:39:00 GMT

Do it this way -

| eval src=replace(src,"\""."")

| rex field=src "\"?(?<src>[\d\.]+)\"?"

shivi_tcs — Tue, 06 Jun 2017 07:36:40 GMT

thanks for the answer. It works well

Keysofsandiego — Mon, 14 Aug 2023 18:47:50 GMT

Hey great rex, but the eval does not workwith a period, atleast it didnt for me. I replaced the period (pun) with a comma and it is now working

| eval src=replace(src,"\"","")

happy splunkin' pard 😁