How to remove Double quotes from a ip field values?

[shivi_tcs]

Hello All,

I have a field named src which contains IP's but with double quotes around them.
I want to remove the double quotes from these values.

Example
extracted value src="10.23.25.23"
needed value src=10.23.25.23

[dineshraj9 · Accepted solution]

Do it this way -

| eval src=replace(src,"\""."")

OR

| rex field=src "\"?(?<src>[\d\.]+)\"?"

[Keysofsandiego]

Hey great rex, but the eval does not workwith a period, atleast it didnt for me. I replaced the period (pun) with a comma and it is now working

| eval src=replace(src,"\"","")

 happy splunkin' pard 😁

[shivi_tcs]

thanks for the answer. It works well