topic Replace single quotes with double quotes in Getting Data In

Replace single quotes with double quotes

daniel333 — Fri, 25 Aug 2017 01:00:42 GMT

All,

We have a lot of key value pairs using single quotes. I am THINKING there is a way to fix this using SEDCMD. But honeslty I don't see how. Any ideas? I can do them as one offs pretty easy, but I'd rather just have one SEDCMD for it all.

myvariable='wedfwerfwe' would be myvariable="wedfwerfwe"

Re: Replace single quotes with double quotes

Grumpalot — Fri, 25 Aug 2017 01:44:51 GMT

@daniel333 take a look at the following document

https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Anonymizedata

There may be a few ways you can address in a props.conf

if you are able to regex out where your KV pairs are coming from you can use that solution.

If not then the other option will be doing a complete replace of ' to " in that file source.