Getting Data In

Regex to remove quotes in the middle of string

ethanthomas
Path Finder

I am looking to get a regex to remove the double quotes in the middle of the below string .

message="filtername prefix "8610: ABCD: test purpose"

message="filtername prefix "CP9832: ABCD: test purpose"

 

I need to get as

message="filtername prefix 8610: ABCD: test purpose"

message="filtername prefix CP9832: ABCD: test purpose"

In Props conf file i have updated as 

SEDCMD-removeDoubleQuotes = s/(\")\d/g

will this help ? I am learning Regex 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The provided SEDCMD string fixes half of the examples, but not all of them, as it only replaces quotation marks followed by a digit.

Try SEDCMD-removeDoubleQuotes = s/\s"/\s/g

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...