Splunk Search

Trimming one double quote from beginning of matching field values

mbasharat
Builder

Hi,

I have a field name "Software" in my search results. Field values are:

"Java Development Kit 1.5
"Java Development Kit 1.7
"SUN Java Development Kit
"SUN Java Runtime Environment
Adobe Reader
Apache 1.3
.....and so values go on......

I need the double quote removed/trimmed which is present at the beginning of every value that will have them. I have tried using eval, rex with various combinations but it is not working giving error as "Unbalanced quotes"

Thanks in advance!!!!

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

..| eval Software= replace(Software, "\"", "")

OR

| rex mode=sed field=Software "s/\"//g"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

..| eval Software= replace(Software, "\"", "")

OR

| rex mode=sed field=Software "s/\"//g"
0 Karma

mbasharat
Builder

THANK YOU!!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...