CSV Lookup not matching double quotes

[keerthana_k]

I have created a csv file mapping a field from my raw index to a more readable version. Some of the values for that field in my log has double quotes. I have also included quotes in my csv file for those values. However, the values with double quotes are not getting matched. For the other values, the lookup is working fine. Any ideas how to overcome this and include double quotes in the lookup? Thanks in advance.

[romantic_warrio]

Thanks for responding.

I looked at the CSV and the "appId" field is not quoted; in the database (using DB Connect Input Service) the "RELATED_AIT_NUMBER" the field is defined as an int.

I have a workaround for now by modifying my query to join on the app table in the database and aliasing the field so my searches don't break. I'm thinking that there must be a way to tell how Splunk sees the fields. When I figure this out, I will post the solution here.

[mthierbel · Accepted solution]

I was able to get this working by using three double-quotes.

If my field looks like this:

"foo"

Then my .csv lookup matches it if I set it as

"""foo"""

So, overall, my lookup table would look like this (with the top line being the header):

field1,field2
"""foo""",bar