<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to remove double quotes from a token using the replace method? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524629#M88560</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781"&gt;@renjith_nair&lt;/a&gt;&amp;nbsp;&lt;BR /&gt;Good hint!&lt;BR /&gt;Unfortunately it wouldn't work either because my token is of the multiselect type&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="multiselect" token="support_group_token"&amp;gt;
      &amp;lt;label&amp;gt;Support Group&amp;lt;/label&amp;gt;
      &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
      &amp;lt;search base="filters_base_search"&amp;gt;
        &amp;lt;query&amp;gt;
          | stats count by support_group
        &amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;support_group&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;support_group&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;valuePrefix&amp;gt;support_group="&amp;lt;/valuePrefix&amp;gt;
      &amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;
      &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 14 Oct 2020 13:38:51 GMT</pubDate>
    <dc:creator>diogenesloazeve</dc:creator>
    <dc:date>2020-10-14T13:38:51Z</dc:date>
    <item>
      <title>How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524467#M88539</link>
      <description>&lt;P&gt;Hello!&lt;BR /&gt;&lt;BR /&gt;I have the token() whose content is this:&amp;nbsp;&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;$support_group_token$=&lt;STRONG&gt;support_group="Service Desk"&lt;/STRONG&gt;&lt;/P&gt;&lt;P class="lia-indent-padding-left-30px"&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is there any way to remove the quotes from the token?&lt;BR /&gt;I tried to remove the double quotes using single quotes but the replace didn't work.&lt;/P&gt;&lt;P&gt;|eval my_variable = IF(replace('support_group="Service Desk","\"","")="support_group=Service Desk",1,0)&lt;BR /&gt;|table my_variable&lt;BR /&gt;&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MY_VARIABLE.PNG" style="width: 157px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11274iC9E8B9BB95AB8E80/image-size/large?v=v2&amp;amp;px=999" role="button" title="MY_VARIABLE.PNG" alt="MY_VARIABLE.PNG" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Has anyone experienced the same problem?&lt;/P&gt;&lt;P&gt;Basically I want to get the result below but the problem is that my token doesn't have the &lt;STRONG&gt;\"&lt;/STRONG&gt; between the Service Desk name.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture2.PNG" style="width: 771px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/11275i3A63698D4743CE38/image-size/large?v=v2&amp;amp;px=999" role="button" title="Capture2.PNG" alt="Capture2.PNG" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 13 Oct 2020 18:11:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524467#M88539</guid>
      <dc:creator>diogenesloazeve</dc:creator>
      <dc:date>2020-10-13T18:11:47Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524526#M88550</link>
      <description>&lt;P&gt;You may use the same solution.. \ is used to escape the quotes.&lt;/P&gt;&lt;P&gt;Please check this&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|makeresults |eval field="support_group=\"Service Desk\""
|eval new_field=replace(field,"\"","")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 14 Oct 2020 04:14:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524526#M88550</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2020-10-14T04:14:55Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524600#M88555</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781"&gt;@renjith_nair&lt;/a&gt;&amp;nbsp;Thanks for the answer!&lt;BR /&gt;&lt;BR /&gt;Unfortunately this solution does not work for me because the token already comes to me this way (support_group="Service Desk").&lt;BR /&gt;I have to work with the double quotes anyway.&lt;BR /&gt;&lt;BR /&gt;I think the solution is in what character do I have to put before &lt;EM&gt;&lt;STRONG&gt;support&lt;/STRONG&gt; &lt;/EM&gt;and after &lt;EM&gt;&lt;STRONG&gt;Desk&lt;/STRONG&gt;&lt;/EM&gt;.&lt;BR /&gt;Unfortunately trying something like this didn't work for me either:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|makeresults |eval field=\"support_group="Service Desk"\"&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 14 Oct 2020 11:50:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524600#M88555</guid>
      <dc:creator>diogenesloazeve</dc:creator>
      <dc:date>2020-10-14T11:50:31Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524603#M88556</link>
      <description>&lt;P&gt;If you are trying to set a token in XML try&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;eval token="my_variable"&amp;gt;replace($support_group_token$,"\"","")&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 14 Oct 2020 12:37:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524603#M88556</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-10-14T12:37:59Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524609#M88557</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/57957"&gt;@diogenesloazeve&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;Here is an example with token. Let me know if this is what you are looking for.&lt;/P&gt;&lt;P&gt;Used $token|s$ to escape the token and replaced&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Token Special&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="dropdown" token="category"&amp;gt;
      &amp;lt;label&amp;gt;Category&amp;lt;/label&amp;gt;
      &amp;lt;choice value="support_group=&amp;amp;quot;Service Desk&amp;amp;quot;"&amp;gt;SupportGroup&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="support_level=&amp;amp;quot;Level1&amp;amp;quot;"&amp;gt;SupportLevel&amp;lt;/choice&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;title&amp;gt;Category  : $category$&amp;lt;/title&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;|makeresults|eval category=$category|s$|eval new_category=replace($category|s$,"\"","")&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-15m&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 14 Oct 2020 12:41:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524609#M88557</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2020-10-14T12:41:45Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524629#M88560</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781"&gt;@renjith_nair&lt;/a&gt;&amp;nbsp;&lt;BR /&gt;Good hint!&lt;BR /&gt;Unfortunately it wouldn't work either because my token is of the multiselect type&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="multiselect" token="support_group_token"&amp;gt;
      &amp;lt;label&amp;gt;Support Group&amp;lt;/label&amp;gt;
      &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
      &amp;lt;search base="filters_base_search"&amp;gt;
        &amp;lt;query&amp;gt;
          | stats count by support_group
        &amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;support_group&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;support_group&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;valuePrefix&amp;gt;support_group="&amp;lt;/valuePrefix&amp;gt;
      &amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;
      &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 14 Oct 2020 13:38:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524629#M88560</guid>
      <dc:creator>diogenesloazeve</dc:creator>
      <dc:date>2020-10-14T13:38:51Z</dc:date>
    </item>
    <item>
      <title>Re: How to remove double quotes from a token using the replace method?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524631#M88561</link>
      <description>&lt;P&gt;Thank you &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;!&lt;BR /&gt;This worked perfectly!&lt;/P&gt;</description>
      <pubDate>Wed, 14 Oct 2020 13:40:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-remove-double-quotes-from-a-token-using-the-replace/m-p/524631#M88561</guid>
      <dc:creator>diogenesloazeve</dc:creator>
      <dc:date>2020-10-14T13:40:19Z</dc:date>
    </item>
  </channel>
</rss>

