Getting Data In

Replace single quotes with double quotes

daniel333
Builder

All,

We have a lot of key value pairs using single quotes. I am THINKING there is a way to fix this using SEDCMD. But honeslty I don't see how. Any ideas? I can do them as one offs pretty easy, but I'd rather just have one SEDCMD for it all.

myvariable='wedfwerfwe' would be myvariable="wedfwerfwe"

0 Karma

Grumpalot
Communicator

@daniel333 take a look at the following document

https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Anonymizedata

There may be a few ways you can address in a props.conf

if you are able to regex out where your KV pairs are coming from you can use that solution.

If not then the other option will be doing a complete replace of ' to " in that file source.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...