Splunk Search

How to remove double quotes from extracted field values

Sekhar
Explorer

Filed extracted like rex field = msg " student information\" : (?<studentname>.*?),"

 

Student name getting like below

"Stdent570"

"55555sdeend"

I want data with our double quotes 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

if you could share some sample of your data I can be more sure.

anyway, you should try something like this:

| rex field=msg "student\s+information\"\s+:\s+\"(?<studentname>[^\"]*)"

Ciao.

Giuseppe

Sekhar
Explorer

Sample data format

{\"studenrinformation\" :  \"student577474\", }

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sekhar,

please trys this:

| rex field=msg "studentinformation\\\"\s+:\s+\\\"(?<studentname>[^\"]*)"

that you can test at https://regex101.com/r/GQVTYF/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...