rex during search convert to transforms/props during indexing help

[jtm7x2]

Hello.  I have a data source that is "mostly" json formatted, except it uses single quotes instead of double, therefore, splunk is not honoring it if I set the sourcetype to json.

If I run a query against it using this:

sourcetype="test" | rex field=_raw mode=sed "s/'/\"/g"
| spath

it works fine, and all fields are extracted.

How can I configure props and transforms to perform this change at index time so that my users don't need to have the additional search parameters and all the fields are extracted by default, short of manually extracting each field?

Example event, no nested fields:

{'date': '2024-02-10', 'time': '18:59:27', 'field1': 'foo', 'field2': 'bar'}

[marnall]

You can use a SEDCMD to replace all the single quotes with double-quotes before indexing.

in Props.conf:

[yoursourcetype]
SEDCMD-singletodouble=s/\'/\"/g

[jtm7x2 · Accepted solution]

Thanks.  I got it to work, but had to modify the syntax slightly to remove the backslashes - this worked.

[yoursourcetype]
SEDCMD-singletodouble=s/'/"/g