Getting Data In

Remove double quotes from the middle , but not from the last .

ethanthomas1
New Member

I have an issue to remove the double quotes from the middle of a string. Example below 

"My Name "is Ethan".

Here i want to retain the quotes in the front and back , but remove the one from middle. I used the SED CMD as SEDCMD-removeDoubleQuotes= s/\s"//g

This perfectly worked as i got the output as expected below 

"My Name is Ethan"

But the problem is , sometime the last double quotes comes with a space before it . Because of that, the above SEDCMD is replacing the double quotes from the last of the string too .

"My Name "is Ethan "

The result is 

"My Name is Ethan 

Can someone help me how to handle this and specifically remove the middle double quotes ? Help is appreciated.  

Labels (3)
0 Karma

Gr0und_Z3r0
Contributor

Hi @ethanthomas1 ,
There will be a better way to do this... but here's a dirty way to do it
Checking if the last character of the string is a quote if not append it.

| makeresults
| eval string1="\"My Name \"is Ethan\""
| eval string2="\"My Name \"is Ethan \""
| rex mode=sed field=string1 "s/\s\"/ /g"
| rex mode=sed field=string2 "s/\s\"/ /g"
| eval string3= if(substr(string1, len(string1), 1)="\"",string1, trim(string1)+"\"")
| eval string4= if(substr(string2, len(string2), 1)="\"",string2, trim(string2)+"\"")
| table string1 string2 string3 string4

.
 

Gr0und_Z3r0_0-1638342301324.png

 

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...