topic Re: Remove string from field using REX in Splunk Search

Remove string from field using REX

Splunkie — Wed, 23 Jul 2025 09:00:36 GMT

I am trying to remove a field which has a suffix of sophos_event_input after the username. Example

Username_Field

Joe-Smith, Adams sophos_event_input

Jane-Doe, Smith sophos_event_input

I would like to change the Username field to only contain the users name, Example

Username_Field

Joe-Smith, Adams

Jane-Doe, Smith

Basically I want to get rid of the sophos_event_input suffix.

How will I go about this?

Re: Remove string from field using REX

gcusello — Wed, 23 Jul 2025 09:08:17 GMT

Hi @Splunkie ,

do you want to do this at index time, recording the modified events or at search time (only in visualization)?

if at search time, you can use a regex in your searches like the following:

| rex mode=sed "s/sophos_event_input/ /g"

if at index time, you should put in the props.conf:

[<your_sourcetype>] SEDCMD = "s/sophos_event_input/ /g"

This conf file must be located in the first full Splunk instance where data pass through, in other words in the first Heavy Forwarder (if present) or otherwise on the Indexers.

Ciao.

Giuseppe

Re: Remove string from field using REX

livehybrid — Wed, 23 Jul 2025 09:36:46 GMT

Hi @Splunkie

Do you want this to affect the raw data (e.g when its indexed) or do you want the original string to exist in the data but also have a field which has it without the suffix?

You could do the following at search time:

| rex field=Username_Field mode=sed "s/ sophos_event_input$//"

(See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex)

Alternatively you could use a REPLACE function:

| eval cleaned_Username=REPLACE(Username_Field," sophos_event_input","")

You could also make this an automatic calculated field so that you dont need to include it in your SPL:

If you want this to be replaced in the _raw event at index time then you need to deploy a props.conf file within a custom app to your HF or Indexers (whichever the data lands on first) with something like this:

# props.conf # [yourSourcetype] SEDCMD-removeSophosSuffix = "s/ sophos_event_input//g"

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Remove string from field using REX

Splunkie — Wed, 23 Jul 2025 10:43:04 GMT

Thanks livehybrid,

The first option worked perfectly. I only wanted the field to be sanitized at search time and the first option does that.

Cheers.