Remove double quotes and slashes from the field

[Rukmani_Splunk]

i  am having field like this below.

message :"{"\payement":"xxx", "\account:" xxx"}"

I  want  the  first  and last  quote .. How to  remove that

[ITWhisperer]

| rex mode=sed field=_raw "s/message :\"\{(.*)\}\"/message :\{\1\}/g" 

[Rukmani_Splunk]

Thank you  so  much  .. but  it didnt  help  may  be issue with  data

Thanks a lot

[venkatasri]

Yes it works for your sample provided starts with message , you can tune regex to match with your data approach remains same.. 

[venkatasri]

Hi @Rukmani_Splunk  Can you try following, you can replace _raw with field name that you said.

<your_search_goes_here>
| rex mode=sed field=_raw "s/message :\"(.*)\"/message :\1/g" 
| eval clean_text=replace(_raw, "\\\\", "")

  Output would be in field called clean_text here,

message :{"payement":"xxx", "account:" xxx"}

---

An upvote would be appreciated and Accept solution if  this reply helps!