Splunk Search

Trimming one double quote from beginning of matching field values

mbasharat
Builder

Hi,

I have a field name "Software" in my search results. Field values are:

"Java Development Kit 1.5
"Java Development Kit 1.7
"SUN Java Development Kit
"SUN Java Runtime Environment
Adobe Reader
Apache 1.3
.....and so values go on......

I need the double quote removed/trimmed which is present at the beginning of every value that will have them. I have tried using eval, rex with various combinations but it is not working giving error as "Unbalanced quotes"

Thanks in advance!!!!

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

..| eval Software= replace(Software, "\"", "")

OR

| rex mode=sed field=Software "s/\"//g"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

..| eval Software= replace(Software, "\"", "")

OR

| rex mode=sed field=Software "s/\"//g"
0 Karma

mbasharat
Builder

THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...