https://community.splunk.com/t5/Getting-Data-In/strip-certain-data-from-field/m-p/465684#M99579 <P>my event has a field Transaction:=InpatUPMC_050_Close_WorklistLoad and i am looking to strip the InpatUPMC_050_ part</P> <P>i tried the rex field=source mode=sed "s/Transaction:=InpatUPMC_050_Close_//g" but does not work.</P> Wed, 30 Sep 2020 04:51:33 GMT MOHITJOSHI 2020-09-30T04:51:33Z https://community.splunk.com/t5/Getting-Data-In/strip-certain-data-from-field/m-p/465684#M99579 <P>my event has a field Transaction:=InpatUPMC_050_Close_WorklistLoad and i am looking to strip the InpatUPMC_050_ part</P> <P>i tried the rex field=source mode=sed "s/Transaction:=InpatUPMC_050_Close_//g" but does not work.</P> Wed, 30 Sep 2020 04:51:33 GMT https://community.splunk.com/t5/Getting-Data-In/strip-certain-data-from-field/m-p/465684#M99579 MOHITJOSHI 2020-09-30T04:51:33Z https://community.splunk.com/t5/Getting-Data-In/strip-certain-data-from-field/m-p/465685#M99580 <P>Try replace function:</P> <PRE><CODE>| eval source=replace(source, "Transaction:=InpatUPMC_050_Close_", "") </CODE></PRE> Thu, 02 Apr 2020 06:04:25 GMT https://community.splunk.com/t5/Getting-Data-In/strip-certain-data-from-field/m-p/465685#M99580 manjunathmeti 2020-04-02T06:04:25Z