Replace single quotes with double quotes

[daniel333]

All,

We have a lot of key value pairs using single quotes. I am THINKING there is a way to fix this using SEDCMD. But honeslty I don't see how. Any ideas? I can do them as one offs pretty easy, but I'd rather just have one SEDCMD for it all.

myvariable='wedfwerfwe' would be myvariable="wedfwerfwe"

[Grumpalot]

@daniel333 take a look at the following document

https://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Anonymizedata

There may be a few ways you can address in a props.conf

if you are able to regex out where your KV pairs are coming from you can use that solution.

If not then the other option will be doing a complete replace of ' to " in that file source.