I have a field named src which contains IP's but with double quotes around them.
I want to remove the double quotes from these values.
extracted value src="10.23.25.23"
needed value src=10.23.25.23
Do it this way -
| eval src=replace(src,"\""."")
| rex field=src "\"?(?<src>[\d\.]+)\"?"
View solution in original post
thanks for the answer. It works well