https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598225#M104367 <LI-CODE lang="markup">| makeresults | eval ip="017.002.100.103" | eval ip=replace(ip,"(^|\.)(0*)(\d+)","\1\3")</LI-CODE> Wed, 18 May 2022 05:06:53 GMT ITWhisperer 2022-05-18T05:06:53Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598105#M104357 <P><SPAN>But the log says 017.002.100.103. I am receiving data from universal forwarder and I would like to remove 0 in front of me Is there a way?</SPAN></P> <P><SPAN>i want 17.2.100.103</SPAN></P> Tue, 17 May 2022 16:53:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598105#M104357 noott211 2022-05-17T16:53:38Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598118#M104358 <P>In search, you can do something like this</P><LI-CODE lang="markup">| makeresults | eval ip="017.002.100.103" | eval ip=replace(ip,"^0*(.+)","\1") </LI-CODE> Tue, 17 May 2022 15:37:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598118#M104358 somesoni2 2022-05-17T15:37:29Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598204#M104364 <P>The command is removed only at the beginning I want every part of it</P> Wed, 18 May 2022 01:02:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598204#M104364 noott211 2022-05-18T01:02:23Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598225#M104367 <LI-CODE lang="markup">| makeresults | eval ip="017.002.100.103" | eval ip=replace(ip,"(^|\.)(0*)(\d+)","\1\3")</LI-CODE> Wed, 18 May 2022 05:06:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-clear-0s-from-the-Ip/m-p/598225#M104367 ITWhisperer 2022-05-18T05:06:53Z