Getting Data In
Highlighted

How do I remove all double quotes from splunk data?

Contributor

My data read into splunk with all double quote around them. How can I delete all of these double quotes from splunk?
This is the data:
alt text

0 Karma
Highlighted

Re: How do I remove all double quotes from splunk data?

SplunkTrust
SplunkTrust

I'm not sure about getting rid of them in raw before indexing but if you are looking for search time field extractions without quotes I'd use props.conf and transforms.conf to achieve this.

Props.conf

[<sourcetype/spec>]
REPORT-extract_quotes = extract_quotes

Transforms.conf

[extract_quotes]
REGEX = [a-zA-Z0-9_]*"(.*?)"
FORMAT = $1::$2

This should extract your fields to be without quotes when searching.

0 Karma
Highlighted

Re: How do I remove all double quotes from splunk data?

SplunkTrust
SplunkTrust

You would have to delete the data, correct your upload process to omit the quotes, and then er-index the data.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.