Knowledge Management

Splunk Extract Command to process single or double quotes

youngc_splunk
Splunk Employee
Splunk Employee

Hello Gurus!

I am sure some people may have run in to this.   I am using extract command to parse fields from multi line unstructured event, but the data values are encapsulated by single quotes.

Here is the example :

====EVENT 1========

2021-09-08 00:00:00 ABC status - performance event
    name : 'James Bond'
    address : 'USA'
    age : '100'
    occupation : 'spy'
performance event END

==================

So the the following event, I am using transforms to 

transforms.conf

[performance_data]
DELIMS = "\r\n", ":"

So above transforms partially works.  The problem is the values has single quote ' encapsulated.

Like this

Field name "name"  with value "'James Bond'".   single quote included.  How can I get rid of the single quote?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...