Hi Splunker,
I would like to lower the string/value present inside the double quotes and then use as it is.
Values highlighted in red are basically string which I would like to convert it into a lower case.
Actual field value :
"AWSURLmonitor_" + url
sourcetype + "SystemRestarted"
"Batch_Comm_critical_alert"."_".to_DST_Filename."-".Time
Expected field value:
"awsurlmonitor" + url
sourcetype + "systemrestarted"
"batch_comm_critical_alert"."_".to_DST_Filename."-".Time
Similarly, like above example, I have multiple data in my environment, my task is to lower case whatever the value present inside the double quotes.
Any help would be really appreciated.
Regards,
Is the text to be down-cased already in its own field or is it part of a field? If the latter, are the quotes present?
The third example has two sets of quoted characters. Does only the first one need to be modified?