topic Re: i want to match the text &quot;followed the escaped error:&quot; and remove the following text till the delimiter dot. it should cut other fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357270#M105690 <P>it should not cut other following fields only it should till dot</P> Mon, 19 Jun 2017 11:52:45 GMT DataOrg 2017-06-19T11:52:45Z i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357269#M105689 <P>followed the escaped error: "An error has happened executing a dash statement. hello good morning<BR /> followed the escaped error: "6g is not a valid for Value of the statement. happy morning</P> Mon, 19 Jun 2017 11:46:49 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357269#M105689 DataOrg 2017-06-19T11:46:49Z Re: i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357270#M105690 <P>it should not cut other following fields only it should till dot</P> Mon, 19 Jun 2017 11:52:45 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357270#M105690 DataOrg 2017-06-19T11:52:45Z Re: i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357271#M105691 <P>Can you try replace command -</P> <P>E.g. </P> <PRE><CODE>| makeresults | eval text="followed the escaped error: \"An error has happened executing a dash statement. hello good morning" | eval text=replace(text,"\:[^\.]+","") </CODE></PRE> Mon, 19 Jun 2017 12:02:34 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357271#M105691 dineshraj9 2017-06-19T12:02:34Z Re: i want to match the text "followed the escaped error:" and remove the following text till the delimiter dot. it should cut other fields https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357272#M105692 <P>Like this:</P> <PRE><CODE>| makeresults | eval text="followed the escaped error: \"An error has happened executing a dash statement. hello good morning" | rex field=text mode=sed "s/\:[^\.]+//" </CODE></PRE> Mon, 19 Jun 2017 13:58:01 GMT https://community.splunk.com/t5/Splunk-Search/i-want-to-match-the-text-quot-followed-the-escaped-error-quot/m-p/357272#M105692 woodcock 2017-06-19T13:58:01Z