How do you include a literal double quote character in a Splunk Regex

[jbrenner]

I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. How do I do this?

Thanks,
Jonathan

[mayurr98]

Hey try this

you can use \ to escape “

For example

Suppose you have user=“xyz” in the event and you want to extract xyz then you can use below regex

| rex field=_raw  “user=\”(?P<user>[^\”])”

You can use regex101.com to learn more !
Let me know if this helps you.

[mayurr98]

If you provide a sample event and tell us want you want to extract then we can write regex for you !
Provide sample event

[elliotproebstel]

You can escape the double-quote by using a backslash. Here's some sample run-anywhere code:

|makeresults 
| eval tf="contains a literal quote \" followed by stuff"
| rex field=tf "\"(?<after_quote_stuff>.*)"

[jplumsdaine22]

Escape it with a . EG if you have foo="bar and you want to extract bar

| rex field=foo "\"(?<bar>[A-z]+)"