Has any one come across hidden Double Quotes (") in a field and how to remove it? (maybe a "sed" regex)
The double quotes don't appear in the Splunk Field or even in an excel csv export.
It only appears when you save the csv as a txt file.
Apparently Splunk sees it because it adds additional lines in my search.
See below for Excel export and corresponding saved txt
It looks to be Quoting the contents of the AdminGroup field.
computer1 "Domain Admins