Getting Data In

Remove double quotes from the middle , but not from the last .

ethanthomas1
New Member

I have an issue to remove the double quotes from the middle of a string. Example below 

"My Name "is Ethan".

Here i want to retain the quotes in the front and back , but remove the one from middle. I used the SED CMD as SEDCMD-removeDoubleQuotes= s/\s"//g

This perfectly worked as i got the output as expected below 

"My Name is Ethan"

But the problem is , sometime the last double quotes comes with a space before it . Because of that, the above SEDCMD is replacing the double quotes from the last of the string too .

"My Name "is Ethan "

The result is 

"My Name is Ethan 

Can someone help me how to handle this and specifically remove the middle double quotes ? Help is appreciated.  

Labels (3)
0 Karma

Gr0und_Z3r0
Contributor

Hi @ethanthomas1 ,
There will be a better way to do this... but here's a dirty way to do it
Checking if the last character of the string is a quote if not append it.

| makeresults
| eval string1="\"My Name \"is Ethan\""
| eval string2="\"My Name \"is Ethan \""
| rex mode=sed field=string1 "s/\s\"/ /g"
| rex mode=sed field=string2 "s/\s\"/ /g"
| eval string3= if(substr(string1, len(string1), 1)="\"",string1, trim(string1)+"\"")
| eval string4= if(substr(string2, len(string2), 1)="\"",string2, trim(string2)+"\"")
| table string1 string2 string3 string4

.
 

Gr0und_Z3r0_0-1638342301324.png

 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...