Splunk Search

How to remove double quotes from extracted field values

Sekhar
Explorer

Filed extracted like rex field = msg " student information\" : (?<studentname>.*?),"

 

Student name getting like below

"Stdent570"

"55555sdeend"

I want data with our double quotes 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

if you could share some sample of your data I can be more sure.

anyway, you should try something like this:

| rex field=msg "student\s+information\"\s+:\s+\"(?<studentname>[^\"]*)"

Ciao.

Giuseppe

Sekhar
Explorer

Sample data format

{\"studenrinformation\" :  \"student577474\", }

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

please trys this:

| rex field=msg "studentinformation\\\"\s+:\s+\\\"(?<studentname>[^\"]*)"

that you can test at https://regex101.com/r/GQVTYF/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...