https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216848#M176010 <PRE><CODE>... | eval newfield=replace(Indicator_Value,"[\[\]]","") </CODE></PRE> Fri, 30 Dec 2016 16:47:01 GMT twinspop 2016-12-30T16:47:01Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216847#M176009 <P>Hi,</P> <P>Can someone please help with formatting IP address or FQDN,we nee to remove [ ] in the below.</P> <P>These below details are available in field name "Indicator_Value"</P> <PRE><CODE>221[.]138[.]128[.]116 www[.]cderlearn[.]com </CODE></PRE> <P>Thanks</P> Fri, 30 Dec 2016 16:39:42 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216847#M176009 splunker9999 2016-12-30T16:39:42Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216848#M176010 <PRE><CODE>... | eval newfield=replace(Indicator_Value,"[\[\]]","") </CODE></PRE> Fri, 30 Dec 2016 16:47:01 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216848#M176010 twinspop 2016-12-30T16:47:01Z https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216849#M176011 <P>Try this using <CODE>mode=sed</CODE></P> <PRE><CODE>your query to return events | rex field=Indicator_Value mode=sed "s/\[//g s/\]//g" </CODE></PRE> <P>Please ensure to keep the string <CODE>"s/\[//g</CODE> and <CODE>s/\]//g"</CODE> split over two lines exactly how it appears in the query. Take care of the <CODE>" (double quotes)</CODE> to be same as it appears in the query.</P> Fri, 30 Dec 2016 22:14:15 GMT https://community.splunk.com/t5/Splunk-Search/Regex-help/m-p/216849#M176011 gokadroid 2016-12-30T22:14:15Z