https://community.splunk.com/t5/Splunk-Enterprise/rex-field/m-p/577129#M10876 <P>Try this</P><LI-CODE lang="markup">| rex mode=sed "s/(\w{3})\w* (.*)/\1 \2/g"</LI-CODE> Thu, 02 Dec 2021 19:50:22 GMT richgalloway 2021-12-02T19:50:22Z https://community.splunk.com/t5/Splunk-Enterprise/rex-field/m-p/577071#M10870 <P>Need help on trimming the month from the field&nbsp;</P><P>EX:&nbsp; Input&nbsp; &nbsp; &nbsp; November 29, 2021 2:02:33 PM&nbsp;<BR /><BR /></P><P>&nbsp; &nbsp; &nbsp; &nbsp; output&nbsp; &nbsp;Nov&nbsp;29, 2021 2:02:33 PM&nbsp;</P><P>for all month in the field&nbsp;</P><P>Thanks&nbsp;</P> Thu, 02 Dec 2021 14:53:28 GMT https://community.splunk.com/t5/Splunk-Enterprise/rex-field/m-p/577071#M10870 shreyasamin64 2021-12-02T14:53:28Z https://community.splunk.com/t5/Splunk-Enterprise/rex-field/m-p/577129#M10876 <P>Try this</P><LI-CODE lang="markup">| rex mode=sed "s/(\w{3})\w* (.*)/\1 \2/g"</LI-CODE> Thu, 02 Dec 2021 19:50:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/rex-field/m-p/577129#M10876 richgalloway 2021-12-02T19:50:22Z