topic Re: remove all text before certain words in events in Splunk Search https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627084#M217930 <LI-CODE lang="markup">| eval ErrorInfo = mvindex(split(ErrorInfo, ":"),1)</LI-CODE> Fri, 13 Jan 2023 16:41:11 GMT ITWhisperer 2023-01-13T16:41:11Z remove all text before certain words in events https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627083#M217929 <P>I have events like below</P><P>-a3bcd: Info1234x:NullValue</P><P>-a3bcd: Info1234x:NullValue</P><P>-b3bcd: Info1234x:NullValue2</P><P>-c3bcd: Info1234x:NullValue3</P><P>&nbsp;</P><P>I managed to produce a table like these</P><P>ErrorInfo&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Count</P><P>a3bcd: Info1234x:NullValue&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P><P>-b3bcd: Info1234x:NullValue2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>-c3bcd: Info1234x:NullValue3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>I would like to condense those events into one since they are all same kind of error just different paramter</P><P>so it would be like</P><P>ErrorInfo&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Count</P><P>Info1234x:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P><BR />Thanks in advance</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 13 Jan 2023 16:38:56 GMT https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627083#M217929 trilocho 2023-01-13T16:38:56Z Re: remove all text before certain words in events https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627084#M217930 <LI-CODE lang="markup">| eval ErrorInfo = mvindex(split(ErrorInfo, ":"),1)</LI-CODE> Fri, 13 Jan 2023 16:41:11 GMT https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627084#M217930 ITWhisperer 2023-01-13T16:41:11Z Re: remove all text before certain words in events https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627099#M217934 <P>It didt work</P> Fri, 13 Jan 2023 19:37:00 GMT https://community.splunk.com/t5/Splunk-Search/remove-all-text-before-certain-words-in-events/m-p/627099#M217934 trilocho 2023-01-13T19:37:00Z