https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631223#M219247 <P>rex works with pattern matching - is it just this exact string you want to remove or are there similar strings? If so, what pattern do the strings follow? This is key to determining what regular expression to use.</P> Thu, 16 Feb 2023 17:10:15 GMT ITWhisperer 2023-02-16T17:10:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631205#M219239 <P>Hi,</P> <P>I have the bellow event:</P> <P>&nbsp;</P> <P>{"log":"2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 connection.go:153]</P> <P>connecting to UNIX:///csi/csi.sock"</P> <P>I need to remove&nbsp;2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359 and have tried rex but unable to do so, just wondered if someone could help me?</P> <P>&nbsp;</P> <P>Thanks,</P> <P>Joe</P> Thu, 16 Feb 2023 17:05:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631205#M219239 joe06031990 2023-02-16T17:05:28Z https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631221#M219246 <P>By "remove" do you mean you want to get rid of that text or extract it into fields?</P><P>What regular expressions (<FONT face="courier new,courier">rex</FONT> commands) have you tried so far?</P> Thu, 16 Feb 2023 16:59:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631221#M219246 richgalloway 2023-02-16T16:59:23Z https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631223#M219247 <P>rex works with pattern matching - is it just this exact string you want to remove or are there similar strings? If so, what pattern do the strings follow? This is key to determining what regular expression to use.</P> Thu, 16 Feb 2023 17:10:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631223#M219247 ITWhisperer 2023-02-16T17:10:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631295#M219270 <P>Yeah I want to completely remove&nbsp;<SPAN>2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359.</SPAN></P> Fri, 17 Feb 2023 08:39:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631295#M219270 joe06031990 2023-02-17T08:39:14Z https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631298#M219271 <LI-CODE lang="markup">| replace "2023-02-16t14:14:25.827471424z stderr F I0216 14:14:25.827359" WITH "" IN _raw</LI-CODE> Fri, 17 Feb 2023 09:06:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-rex-to-remove/m-p/631298#M219271 ITWhisperer 2023-02-17T09:06:03Z