https://community.splunk.com/t5/Splunk-Search/Remove-fixed-string-from-multivalue-field/m-p/167525#M47701 <P>You need the <CODE>replace</CODE> command:</P> <PRE><CODE>| replace "Multiple - *" with "*" in alert </CODE></PRE> Fri, 19 Jun 2015 13:36:36 GMT woodcock 2015-06-19T13:36:36Z https://community.splunk.com/t5/Splunk-Search/Remove-fixed-string-from-multivalue-field/m-p/167524#M47700 <P>Hi,<BR /> I have a field <EM>alert</EM> which contains the following events:<BR /> “Failed Logon”<BR /> “Dropped Database”</P> <P>However, sometimes the source application adds the string “<EM>Multiple -</EM> “ before it. Hence when running <EM>stats</EM> I end up with results like:<BR /> “Failed Logon” 9<BR /> “<STRONG>Multiple -</STRONG> Failed Logon” 1</P> <P>“Dropped Database” 2<BR /> “<STRONG>Multiple -</STRONG> Dropped Database” 3</P> <P>I am looking for way to remove the string “<EM>Multiple -</EM> ” from the event field. The results should look like<BR /> “Failed Logon” 10<BR /> “Dropped Database” 5</P> <P>Appreciate your help!</P> Fri, 19 Jun 2015 13:18:32 GMT https://community.splunk.com/t5/Splunk-Search/Remove-fixed-string-from-multivalue-field/m-p/167524#M47700 shakermaker 2015-06-19T13:18:32Z https://community.splunk.com/t5/Splunk-Search/Remove-fixed-string-from-multivalue-field/m-p/167525#M47701 <P>You need the <CODE>replace</CODE> command:</P> <PRE><CODE>| replace "Multiple - *" with "*" in alert </CODE></PRE> Fri, 19 Jun 2015 13:36:36 GMT https://community.splunk.com/t5/Splunk-Search/Remove-fixed-string-from-multivalue-field/m-p/167525#M47701 woodcock 2015-06-19T13:36:36Z