Splunk Search

How do you include a literal double quote character in a Splunk Regex

jbrenner
Path Finder

I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. How do I do this?

Thanks,
Jonathan

mayurr98
Super Champion

Hey try this

you can use \ to escape “

For example

Suppose you have user=“xyz” in the event and you want to extract xyz then you can use below regex

| rex field=_raw  “user=\”(?P<user>[^\”])”

You can use regex101.com to learn more !
Let me know if this helps you.

mayurr98
Super Champion

If you provide a sample event and tell us want you want to extract then we can write regex for you !
Provide sample event

0 Karma

elliotproebstel
Champion

You can escape the double-quote by using a backslash. Here's some sample run-anywhere code:

|makeresults 
| eval tf="contains a literal quote \" followed by stuff"
| rex field=tf "\"(?<after_quote_stuff>.*)"
0 Karma

jplumsdaine22
Influencer

Escape it with a . EG if you have foo="bar and you want to extract bar

| rex field=foo "\"(?<bar>[A-z]+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...