https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570227#M198743 <P>This works fine . Thank You&nbsp;<SPAN class="UserName lia-user-name lia-user-rank-SplunkTrust lia-component-message-view-widget-author-username"><A href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957" target="_self"><SPAN class="login-bold">richgalloway</SPAN></A></SPAN></P> Fri, 08 Oct 2021 13:50:40 GMT dtccsundar 2021-10-08T13:50:40Z https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570209#M198739 <P>Hi,</P><P>my regex was like below ,</P><P><STRONG>search| rex field=_raw "Status=(?&lt;Status&gt;\"\w+\s+\w+\".*?)," |stats count by Status</STRONG></P><P>My output is like below ,</P><P>Status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; count&nbsp;</P><P>"No Service"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;250</P><P>Service&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 500</P><P>but i am in need of output as below ,</P><P>Status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; count&nbsp;</P><P><STRONG>No Service&nbsp; &nbsp;</STRONG> &nbsp; &nbsp; &nbsp; &nbsp;250</P><P>Service&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;500</P><P>I am in need of status ("No Service") as No Service with double quotes in Output .Please let me know what i am missing here .</P> Fri, 08 Oct 2021 12:38:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570209#M198739 dtccsundar 2021-10-08T12:38:02Z https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570214#M198741 <P>Perhaps a simple sed will do.</P><LI-CODE lang="markup">... | rex mode=sed field=Status "s/\\\"//g"</LI-CODE> Fri, 08 Oct 2021 12:53:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570214#M198741 richgalloway 2021-10-08T12:53:21Z https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570227#M198743 <P>This works fine . Thank You&nbsp;<SPAN class="UserName lia-user-name lia-user-rank-SplunkTrust lia-component-message-view-widget-author-username"><A href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957" target="_self"><SPAN class="login-bold">richgalloway</SPAN></A></SPAN></P> Fri, 08 Oct 2021 13:50:40 GMT https://community.splunk.com/t5/Splunk-Search/how-to-remove-the-double-quotes-using-regex/m-p/570227#M198743 dtccsundar 2021-10-08T13:50:40Z