If I have a field value with double quotes, how do I get a Splunk search to ignore the double quotes to display the entire value?

[tdiestel]

HI All;

I have data which contains many events like this:

event_name="test"
action_name="widgets_panel"
action_params="{"content_source":"news_and_media"}"

When I do a command like this ...|table event_name action_name action_params, the results look like this: test, widgets_panel, {

I see that the double quotes in the action_params is causing this issue, and my question here is, "is there a work around to pull in all of {"content_source":"news_and_media"} when I call the action_param field?"

Thanks,
Tyler

[nnmiller]

Looking at some of the other JSON answers, I tried setting KV_MODE=auto_escaped but that did not eliminate the issue in my testing.
So you'll need to set up field extractions as somesoni2 suggested.

Example (assuming data above is the exact event format):

^(?:[^=\n]*=){3}(?P<actionparams>.+)

You'll have to adjust the regex if there's more data following the action_params KV pair that has similar KV pairs to extract.

If you have the option to modify the log format of these messages, it seems like the best way would be to remove the quotes before the brackets. That turns the events into legal JSON, so they should be automatically extracted.

[somesoni2]

You'd probably have to setup custom field extractions. Can you provide some sample events, keeping original line breaks?