Getting Data In

Regex to remove quotes in the middle of string

ethanthomas
Path Finder

I am looking to get a regex to remove the double quotes in the middle of the below string .

message="filtername prefix "8610: ABCD: test purpose"

message="filtername prefix "CP9832: ABCD: test purpose"

 

I need to get as

message="filtername prefix 8610: ABCD: test purpose"

message="filtername prefix CP9832: ABCD: test purpose"

In Props conf file i have updated as 

SEDCMD-removeDoubleQuotes = s/(\")\d/g

will this help ? I am learning Regex 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The provided SEDCMD string fixes half of the examples, but not all of them, as it only replaces quotation marks followed by a digit.

Try SEDCMD-removeDoubleQuotes = s/\s"/\s/g

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...