https://community.splunk.com/t5/Splunk-Enterprise/How-to-replace-values-of-raw-events-before-it-getting-indexed/m-p/614325#M13989 <P>These articles could help you:</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Masking-data-using-regex-during-Indexing/m-p/319796" target="_blank">https://community.splunk.com/t5/Splunk-Search/Masking-data-using-regex-during-Indexing/m-p/319796</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata</A></P> Fri, 23 Sep 2022 14:05:12 GMT FelixLeh 2022-09-23T14:05:12Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-replace-values-of-raw-events-before-it-getting-indexed/m-p/614318#M13988 <P>Hello All,</P> <P>I am kind of new into splunk. Need help to remove "ms" from the below data sets even before this data is being indexed so that i can use tstats command on these values to create faster searches. Could anyone please help with this.</P> <P>Sample data:</P> <P><SPAN>2022-09-11 22:00:59,998 INFO -(Success:true)-(Validation:true)-(GUID:68D74EBE-CE3B-7508-6028-CBE1DFA90F8A)-(REQ_RCVD:2022-09-11T22:00:59.051)-(RES_SENT:2022-09-11T22:00:59.989)-(SIZE:2 KB)-(RespSent_TT:0ms)-(Actual_TT:938ms)-(DB_TT:9ms)-(Total_TT:947ms)-(AppServer_TT:937ms)</SPAN></P> <P>&nbsp;</P> <P><SPAN>How do i remove the string "ms" after all the response times in this data.</SPAN></P> Fri, 23 Sep 2022 15:42:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-replace-values-of-raw-events-before-it-getting-indexed/m-p/614318#M13988 dsenapaty 2022-09-23T15:42:45Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-replace-values-of-raw-events-before-it-getting-indexed/m-p/614325#M13989 <P>These articles could help you:</P><P><A href="https://community.splunk.com/t5/Splunk-Search/Masking-data-using-regex-during-Indexing/m-p/319796" target="_blank">https://community.splunk.com/t5/Splunk-Search/Masking-data-using-regex-during-Indexing/m-p/319796</A></P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata</A></P> Fri, 23 Sep 2022 14:05:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-replace-values-of-raw-events-before-it-getting-indexed/m-p/614325#M13989 FelixLeh 2022-09-23T14:05:12Z