Getting Data In

Regex to remove quotes in the middle of string

ethanthomas
Path Finder

I am looking to get a regex to remove the double quotes in the middle of the below string .

message="filtername prefix "8610: ABCD: test purpose"

message="filtername prefix "CP9832: ABCD: test purpose"

 

I need to get as

message="filtername prefix 8610: ABCD: test purpose"

message="filtername prefix CP9832: ABCD: test purpose"

In Props conf file i have updated as 

SEDCMD-removeDoubleQuotes = s/(\")\d/g

will this help ? I am learning Regex 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The provided SEDCMD string fixes half of the examples, but not all of them, as it only replaces quotation marks followed by a digit.

Try SEDCMD-removeDoubleQuotes = s/\s"/\s/g

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...