My data read into splunk with all double quote around them. How can I delete all of these double quotes from splunk?
This is the data:
You would have to delete the data, correct your upload process to omit the quotes, and then er-index the data.
I'm not sure about getting rid of them in raw before indexing but if you are looking for search time field extractions without quotes I'd use props.conf and transforms.conf to achieve this.
Props.conf
[<sourcetype/spec>]
REPORT-extract_quotes = extract_quotes
Transforms.conf
[extract_quotes]
REGEX = [a-zA-Z0-9_]*"(.*?)"
FORMAT = $1::$2
This should extract your fields to be without quotes when searching.