topic Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed &quot;s/Modified\S+//g &quot; in Splunk Search https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352089#M104196 <P>Can you provide a sample, what the event is and what you want to extract out of that event ?</P> Tue, 13 Jun 2017 11:12:13 GMT abhinav_maxonic 2017-06-13T11:12:13Z i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g " https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352088#M104195 <P>Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; Modified: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified</P> Tue, 13 Jun 2017 11:02:26 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352088#M104195 DataOrg 2017-06-13T11:02:26Z Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g " https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352089#M104196 <P>Can you provide a sample, what the event is and what you want to extract out of that event ?</P> Tue, 13 Jun 2017 11:12:13 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352089#M104196 abhinav_maxonic 2017-06-13T11:12:13Z Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g " https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352090#M104197 <P>i want to cut\remove all the character when "Modified" is Present.</P> <P>EX : Extesnded value Associaated With destiny: "LineIces" - "Actio1n Cod2e"; <STRONG>Modified</STRONG>: Extends Aribute - "Action"; Old Value = "Add"; New Value = "-" Modified</P> Tue, 13 Jun 2017 11:19:53 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352090#M104197 DataOrg 2017-06-13T11:19:53Z Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g " https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352091#M104198 <P>So if there is field A . When word "Modified" in NOT present in the event, value of A="Add" and when word "Modified" is present is the event, value of A="-" . Is this what you want ?</P> Tue, 13 Jun 2017 11:35:37 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352091#M104198 abhinav_maxonic 2017-06-13T11:35:37Z Re: i want to cut all the words after Modified at first present. i used the command its only cutting Modified value others are still presents. | rex field=ER mode=sed "s/Modified\S+//g " https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352092#M104199 <P>Like this:</P> <PRE><CODE>| rex field=ER mode=sed "s/Modified\S+.*$//g " </CODE></PRE> <P>But maybe the <CODE>\S</CODE> should be <CODE>\s</CODE> so try this if that doesn't work:</P> <PRE><CODE>| rex field=ER mode=sed "s/Modified\s+.*$//g " </CODE></PRE> <P>Or maybe actually this:</P> <PRE><CODE>| rex field=ER mode=sed "s/Modified:\s+.*$//g " </CODE></PRE> Tue, 13 Jun 2017 12:15:19 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-cut-all-the-words-after-Modified-at-first-present-i/m-p/352092#M104199 woodcock 2017-06-13T12:15:19Z