splunk queries to insert special characters in field values

[splunker12er]

How to insert apostrophes in all field values

Results:

group         count
10.243.200.14   1
10.243.200.29   1
10.243.200.67   1

expected o/p:

 group          count
"10.243.200.14" 1
"10.243.200.29" 1
"10.243.200.67" 1

[woodcock]

There are a kazillion ways to do it:

... | rex mode=sed field=group "s/(.*)/\"\1\"/"

[fdi01]

see answers of jeffland above it ok or
you can also try like :

....| eval group="\""+group+"\""

[jeffland]

If you want them to be in the data (i.e. for later csv export or further calculations), you can add quotes like this:

your search | eval group="\"".group."\""

Keep in mind that this changes the actual value of your field. If you simply want to display quotes around your fields in the table, use fieldformat:

your search | fieldformat group="\"".group."\""

This will only change how your data is rendered in the table, not the actual field values.