topic Re: Remove double quotes and slashes from the field in Splunk Search

Remove double quotes and slashes from the field

Rukmani_Splunk — Wed, 07 Jul 2021 13:19:31 GMT

i am having field like this below.

message :"{"\payement":"xxx", "\account:" xxx"}"

I want the first and last quote .. How to remove that

venkatasri — Thu, 08 Jul 2021 06:48:13 GMT

Hi @Rukmani_Splunk Can you try following, you can replace _raw with field name that you said.

<your_search_goes_here> | rex mode=sed field=_raw "s/message :\"(.*)\"/message :\1/g" | eval clean_text=replace(_raw, "\\\\", "")

Output would be in field called clean_text here,

message :{"payement":"xxx", "account:" xxx"}

---

An upvote would be appreciated and Accept solution if this reply helps!

Rukmani_Splunk — Thu, 08 Jul 2021 07:55:08 GMT

Thank you so much .. but it didnt help may be issue with data

Thanks a lot

venkatasri — Thu, 08 Jul 2021 08:52:04 GMT

Yes it works for your sample provided starts with message , you can tune regex to match with your data approach remains same..

ITWhisperer — Thu, 08 Jul 2021 11:00:29 GMT

| rex mode=sed field=_raw "s/message :\"\{(.*)\}\"/message :\{\1\}/g"