https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523198#M147567 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/69091">@adrianrepublic</a>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval device=867723030939341 |rex field=device "\d{8}(?&lt;deviceid&gt;.*)" | table device deviceid</LI-CODE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rex-digits.jpg" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11137iF1F4D2C7705D9890/image-size/large?v=v2&amp;px=999" role="button" title="rex-digits.jpg" alt="rex-digits.jpg" /></span></P> Tue, 06 Oct 2020 14:02:52 GMT inventsekar 2020-10-06T14:02:52Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523193#M147565 <P>I have a set of devices that are identified by a very long 15 number.</P><P>&nbsp;</P><P>The first 8 numbers are just a prefix which we would like to hide and only display last 7 numbers</P><P>&nbsp;</P><P><SPAN>867723030939341 is an example</SPAN></P><P>&nbsp;</P><P>index=index1 sourcetype=devices | stats count by device....</P><P>&nbsp;</P><P>Is there a ay to rem</P> Tue, 06 Oct 2020 13:51:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523193#M147565 adrianrepublic 2020-10-06T13:51:46Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523196#M147566 <LI-CODE lang="markup">| rex field=device mode=sed "s/^\d{8}//g"</LI-CODE><P>or</P><LI-CODE lang="markup">| eval device=substr(device,9)</LI-CODE> Tue, 06 Oct 2020 13:59:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523196#M147566 ITWhisperer 2020-10-06T13:59:27Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523198#M147567 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/69091">@adrianrepublic</a>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval device=867723030939341 |rex field=device "\d{8}(?&lt;deviceid&gt;.*)" | table device deviceid</LI-CODE><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rex-digits.jpg" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11137iF1F4D2C7705D9890/image-size/large?v=v2&amp;px=999" role="button" title="rex-digits.jpg" alt="rex-digits.jpg" /></span></P> Tue, 06 Oct 2020 14:02:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523198#M147567 inventsekar 2020-10-06T14:02:52Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523200#M147568 <P>Worked a treat!</P> Tue, 06 Oct 2020 14:03:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-first-8-numbers-of-a-field/m-p/523200#M147568 adrianrepublic 2020-10-06T14:03:54Z