how to remove the double quotes using regex

[dtccsundar]

Hi,

my regex was like below ,

search| rex field=_raw "Status=(?<Status>\"\w+\s+\w+\".*?)," |stats count by Status

My output is like below ,

Status                      count 

"No Service"           250

Service                      500

but i am in need of output as below ,

Status                      count 

No Service           250

Service                   500

I am in need of status ("No Service") as No Service with double quotes in Output .Please let me know what i am missing here .

[richgalloway · Accepted solution]

Perhaps a simple sed will do.

... | rex mode=sed field=Status "s/\\\"//g"

[dtccsundar]

This works fine . Thank You richgalloway