Getting Data In

Regex to remove quotes in the middle of string

ethanthomas
Explorer

I am looking to get a regex to remove the double quotes in the middle of the below string .

message="filtername prefix "8610: ABCD: test purpose"

message="filtername prefix "CP9832: ABCD: test purpose"

 

I need to get as

message="filtername prefix 8610: ABCD: test purpose"

message="filtername prefix CP9832: ABCD: test purpose"

In Props conf file i have updated as 

SEDCMD-removeDoubleQuotes = s/(\")\d/g

will this help ? I am learning Regex 

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The provided SEDCMD string fixes half of the examples, but not all of them, as it only replaces quotation marks followed by a digit.

Try SEDCMD-removeDoubleQuotes = s/\s"/\s/g

---
If this reply helps you, Karma would be appreciated.

bowesmana
SplunkTrust
SplunkTrust

SEDCMD change would simply need to be

s/\"//g

Syntax is 

s/change_this/to_this/flags

so above you're changing the regex \" (search double quote) and replace with nothing, globally

I see you had a \d in your original - were you actually trying to find the quotes before a digit? If so, it would catch only the first, not the second example.

You don't need the capture group () as you're not using that captured value in the replacement.

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...