https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164778#M46800 <P>I think the forum stripped out part of the answer. Is there a way to see it in "plain text"</P> Thu, 16 Oct 2014 01:58:29 GMT a212830 2014-10-16T01:58:29Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164776#M46798 <P>Hi,</P> <P>I need to do a field extraction on a multi-line event. The values have quotes, and I'm having problems getting the last quotes removed. </P> <P>Here's the data:</P> <P>Bandwidth:<BR /> ClusterUsage: "0"<BR /> LocalUsage: "0"<BR /> Name: "IC999 Zenos"</P> <P>And here's my extraction - it does everything except remove the last quote.<BR /> [\r\n]\s*Name:\s*"(?P[^\r\n]*)(?:[\r\n]|$)</P> Mon, 28 Sep 2020 17:53:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164776#M46798 a212830 2020-09-28T17:53:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164777#M46799 <P>[rn]s*Name:s*\"(?P[^rn]*)\"(?:[rn]|$)</P> Mon, 28 Sep 2020 17:53:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164777#M46799 kml_uvce 2020-09-28T17:53:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164778#M46800 <P>I think the forum stripped out part of the answer. Is there a way to see it in "plain text"</P> Thu, 16 Oct 2014 01:58:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-and-remove-quotes-from-values-in-a-multi/m-p/164778#M46800 a212830 2014-10-16T01:58:29Z