topic How do I remove all double quotes from splunk data? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353370#M64710 <P>My data read into splunk with all double quote around them. How can I delete all of these double quotes from splunk?<BR /> This is the data:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3325iEBF9D12355772AF4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 07 Aug 2017 13:49:15 GMT tamduong16 2017-08-07T13:49:15Z How do I remove all double quotes from splunk data? https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353370#M64710 <P>My data read into splunk with all double quote around them. How can I delete all of these double quotes from splunk?<BR /> This is the data:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3325iEBF9D12355772AF4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 07 Aug 2017 13:49:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353370#M64710 tamduong16 2017-08-07T13:49:15Z Re: How do I remove all double quotes from splunk data? https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353371#M64711 <P>I'm not sure about getting rid of them in raw before indexing but if you are looking for search time field extractions without quotes I'd use props.conf and transforms.conf to achieve this.</P> <P>Props.conf</P> <PRE><CODE>[&lt;sourcetype/spec&gt;] REPORT-extract_quotes = extract_quotes </CODE></PRE> <P>Transforms.conf</P> <PRE><CODE>[extract_quotes] REGEX = [a-zA-Z0-9_]*"(.*?)" FORMAT = $1::$2 </CODE></PRE> <P>This should extract your fields to be without quotes when searching. </P> Mon, 07 Aug 2017 17:22:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353371#M64711 mdsnmss 2017-08-07T17:22:12Z Re: How do I remove all double quotes from splunk data? https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353372#M64712 <P>You would have to delete the data, correct your upload process to omit the quotes, and then er-index the data.</P> Mon, 07 Aug 2017 17:24:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-remove-all-double-quotes-from-splunk-data/m-p/353372#M64712 DalJeanis 2017-08-07T17:24:53Z