topic Regex to remove single quote in Splunk Search

Regex to remove single quote

allladin101 — Mon, 28 Sep 2020 18:10:48 GMT

index=whatever* sourcetype=server  earliest=-3d  | table  USERNAME CLIENT_VERSION_IN |where NOT isnull(SU_USERNAME_IN)|where CLIENT_VERSION_IN=*07_2*

CLIENT_VERSION_IN=*07_2* doesnot seem to work as the value here 'XF_07_2_5474'. Can some one help build a rex or regex so that i could get the data.

Thanks

Re: Regex to remove single quote

MuS — Fri, 14 Nov 2014 06:52:46 GMT

Hi alladin101,

if you want to get something between two ' single quotes, try something like this:

... | head 1 | eval foo="'XF_07_2_5474'" | rex field=foo "\'(?P<myfoo>.+)\'" | table foo myfo

and the result will be like this:

hope this helps ...

cheers, MuS

Re: Regex to remove single quote

allladin101 — Mon, 28 Sep 2020 18:10:51 GMT

this works but i want to use a wild card here in this part :eval foo="'XF_07_2_5474'"

as 5474 may vary. Is that possible?

Re: Regex to remove single quote

MuS — Fri, 14 Nov 2014 07:23:13 GMT

I must admit, I don't fully understand your intensions but sure this will work:

| eval foo="'XF_07_2_*'" | rex field=foo "\'(?P<myfoo>.+)\'" | table foo myfoo

will result in a table looking like this:

foo                  myfoo
'XF_07_2_*' XF_07_2_*

Re: Regex to remove single quote

MuS — Fri, 14 Nov 2014 08:40:46 GMT

can you mark this as answered as well - thx

Re: Regex to remove single quote

cpetterborg — Fri, 14 Nov 2014 15:53:18 GMT

In terms more close to your question, with MuS's reply, use:

index=whatever* sourcetype=server  earliest=-3d  | table  USERNAME CLIENT_VERSION_IN | rex field=CLIENT_VERSION_IN "\'(?P<fixedfield>.+)\'" | table CLIENT_VERSION_IN fixedfield

Completely generic for your case as provided.