All,
We have a lot of key value pairs using single quotes. I am THINKING there is a way to fix this using SEDCMD. But honeslty I don't see how. Any ideas? I can do them as one offs pretty easy, but I'd rather just have one SEDCMD for it all.
myvariable='wedfwerfwe' would be myvariable="wedfwerfwe"
@daniel333 take a look at the following document
https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Anonymizedata
There may be a few ways you can address in a props.conf
if you are able to regex out where your KV pairs are coming from you can use that solution.
If not then the other option will be doing a complete replace of ' to " in that file source.