topic Re: splunk queries to insert special characters in field values in Splunk Search

splunk queries to insert special characters in field values

splunker12er — Thu, 05 Nov 2015 08:11:41 GMT

How to insert apostrophes in all field values

Results:

group         count
10.243.200.14   1
10.243.200.29   1
10.243.200.67   1

expected o/p:

 group          count
"10.243.200.14" 1
"10.243.200.29" 1
"10.243.200.67" 1

jeffland — Thu, 05 Nov 2015 08:22:48 GMT

If you want them to be in the data (i.e. for later csv export or further calculations), you can add quotes like this:

your search | eval group="\"".group."\""

Keep in mind that this changes the actual value of your field. If you simply want to display quotes around your fields in the table, use fieldformat:

your search | fieldformat group="\"".group."\""

This will only change how your data is rendered in the table, not the actual field values.

fdi01 — Thu, 05 Nov 2015 10:51:08 GMT

see answers of jeffland above it ok or
you can also try like :

....| eval group="\""+group+"\""

woodcock — Thu, 05 Nov 2015 13:31:41 GMT

There are a kazillion ways to do it:

... | rex mode=sed field=group "s/(.*)/\"\1\"/"