I have an index with multiple fields, however one of my field could contain multiple quotes.
Id="0001",
Message="The data "test" is not present",
Result="This is a result"
When I check the fields, I have id, Message and Result. However the value of Message is only **The data ** I want to extract the whole **The data "test" is not present** for the value of Message.
I have checked many questions :
- https://answers.splunk.com/answers/29961/how-can-i-extract-a-quoted-field-value-that-includes-a-quoted-string.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
- https://answers.splunk.com/answers/210504/how-to-deal-with-quotes-in-field-values-that-are-c.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
but could not simply get the answer I was looking for. Thank you.
↧