topic Delete redundant information in fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/Delete-redundant-information-in-fields/m-p/508763#M142139 <P>Hallo,</P><P>I would like to investigate the login behaviour of users. I use this search:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9655i42E55D79A4582375/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt.png" alt="Unbenannt.png" /></span></P><P>I receive the following example log:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt2.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9654i26EB7CCC48C82664/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt2.png" alt="Unbenannt2.png" /></span></P><P>The "abstract" function creates the field "Kontoname". This contains the following values:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt3.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9656i1BA7659D3301D32A/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt3.png" alt="Unbenannt3.png" /></span></P><P>The values "Machine01p", "Machine02p", "Machine03p" are double information. How can I remove or exclude these values?</P><P>Many thanks for the support!</P> Mon, 13 Jul 2020 09:41:09 GMT caplog 2020-07-13T09:41:09Z Delete redundant information in fields https://community.splunk.com/t5/Splunk-Search/Delete-redundant-information-in-fields/m-p/508763#M142139 <P>Hallo,</P><P>I would like to investigate the login behaviour of users. I use this search:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9655i42E55D79A4582375/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt.png" alt="Unbenannt.png" /></span></P><P>I receive the following example log:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt2.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9654i26EB7CCC48C82664/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt2.png" alt="Unbenannt2.png" /></span></P><P>The "abstract" function creates the field "Kontoname". This contains the following values:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Unbenannt3.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9656i1BA7659D3301D32A/image-size/medium?v=v2&amp;px=400" role="button" title="Unbenannt3.png" alt="Unbenannt3.png" /></span></P><P>The values "Machine01p", "Machine02p", "Machine03p" are double information. How can I remove or exclude these values?</P><P>Many thanks for the support!</P> Mon, 13 Jul 2020 09:41:09 GMT https://community.splunk.com/t5/Splunk-Search/Delete-redundant-information-in-fields/m-p/508763#M142139 caplog 2020-07-13T09:41:09Z Re: Delete redundant information in fields https://community.splunk.com/t5/Splunk-Search/Delete-redundant-information-in-fields/m-p/508794#M142148 <P>Solution: <A href="https://community.splunk.com/t5/Splunk-Search/Remove-host-name-in-Account-Name-field/m-p/468027" target="_blank">https://community.splunk.com/t5/Splunk-Search/Remove-host-name-in-Account-Name-field/m-p/468027</A></P> Mon, 13 Jul 2020 11:40:50 GMT https://community.splunk.com/t5/Splunk-Search/Delete-redundant-information-in-fields/m-p/508794#M142148 caplog 2020-07-13T11:40:50Z