Getting Data In

Regex to remove quotes in the middle of string

ethanthomas
Explorer

I am looking to get a regex to remove the double quotes in the middle of the below string .

message="filtername prefix "8610: ABCD: test purpose"

message="filtername prefix "CP9832: ABCD: test purpose"

 

I need to get as

message="filtername prefix 8610: ABCD: test purpose"

message="filtername prefix CP9832: ABCD: test purpose"

In Props conf file i have updated as 

SEDCMD-removeDoubleQuotes = s/(\")\d/g

will this help ? I am learning Regex 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The provided SEDCMD string fixes half of the examples, but not all of them, as it only replaces quotation marks followed by a digit.

Try SEDCMD-removeDoubleQuotes = s/\s"/\s/g

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...