https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498464#M138886 <P>Can you provide some sample data with the expected output?</P> Thu, 14 May 2020 06:14:34 GMT vnravikumar 2020-05-14T06:14:34Z https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498461#M138883 <P>I am searching windows event log.</P> <P>Aftre result search complete, Account_Domain contains following value</P> <P>"-<BR /> ABC"</P> <P>How can I left ABC inside??</P> <P>| rex field="Account_Domain" mode=sed "s/([0-9]{4}) /\1,,/" not working</P> Wed, 13 May 2020 04:20:58 GMT https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498461#M138883 keyu921 2020-05-13T04:20:58Z https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498462#M138884 <P>Hi</P> <P>Check this</P> <PRE><CODE>| rex field=Account_Domain max_match=0 "(?P&lt;Account_Domain&gt;\w+)" </CODE></PRE> Wed, 13 May 2020 07:05:21 GMT https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498462#M138884 vnravikumar 2020-05-13T07:05:21Z https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498463#M138885 <PRE><CODE>Become like this </CODE></PRE> <H2>Account_Domain</H2> <P>ALPHA<BR /><BR /> ALPHA</P> Wed, 13 May 2020 07:12:37 GMT https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498463#M138885 keyu921 2020-05-13T07:12:37Z https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498464#M138886 <P>Can you provide some sample data with the expected output?</P> Thu, 14 May 2020 06:14:34 GMT https://community.splunk.com/t5/Splunk-Search/Double-value-in-field/m-p/498464#M138886 vnravikumar 2020-05-14T06:14:34Z