https://community.splunk.com/t5/Getting-Data-In/How-to-export-splunkd-log-from-1-system-and-import-to-another/m-p/501221#M85392 <P>I would to export splunkd.log from production and import it into my sandbox for analysis.</P> <P>Once I export the splunkd.log using raw format, the file is like this.</P> <PRE><CODE>"01-17-2020 13:53:20.815 +0800 INFO loader - Splunkd starting (build 2dc56eaf3546)." "01-17-2020 13:53:20.816 +0800 INFO loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM" "01-17-2020 13:53:20.816 +0800 INFO loader - Maximum number of threads (approximate): 3911" </CODE></PRE> <P>It got double quote around the actual raw data. <BR /> Any quick method to remove it so that I can add it to my sandbox.</P> Wed, 05 Feb 2020 06:36:07 GMT daniel_splunk 2020-02-05T06:36:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-export-splunkd-log-from-1-system-and-import-to-another/m-p/501221#M85392 <P>I would to export splunkd.log from production and import it into my sandbox for analysis.</P> <P>Once I export the splunkd.log using raw format, the file is like this.</P> <PRE><CODE>"01-17-2020 13:53:20.815 +0800 INFO loader - Splunkd starting (build 2dc56eaf3546)." "01-17-2020 13:53:20.816 +0800 INFO loader - Detected 8 (virtual) CPUs, 8 CPU cores, and 7822MB RAM" "01-17-2020 13:53:20.816 +0800 INFO loader - Maximum number of threads (approximate): 3911" </CODE></PRE> <P>It got double quote around the actual raw data. <BR /> Any quick method to remove it so that I can add it to my sandbox.</P> Wed, 05 Feb 2020 06:36:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-export-splunkd-log-from-1-system-and-import-to-another/m-p/501221#M85392 daniel_splunk 2020-02-05T06:36:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-export-splunkd-log-from-1-system-and-import-to-another/m-p/501222#M85393 <P>You can use below awk and sed to remove the leading double quote and trailing double quote.</P> <PRE><CODE>cat my_splunkd_log.csv | awk '{print substr($0,2);}' | sed 's/.$//' &gt; my_splunkd_log.txt </CODE></PRE> Wed, 05 Feb 2020 06:38:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-export-splunkd-log-from-1-system-and-import-to-another/m-p/501222#M85393 daniel_splunk 2020-02-05T06:38:31Z