https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-remove-a-string-from-raw-in-a-search-using/m-p/196319#M56610 <P>I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:</P> <PRE><CODE>[your search] | rex field=_raw mode=sed "s/M4450G//g" </CODE></PRE> Tue, 20 Jan 2015 23:05:58 GMT chanfoli 2015-01-20T23:05:58Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-remove-a-string-from-raw-in-a-search-using/m-p/196318#M56609 <P>Hello,</P> <P>I'm trying to remove a string from the _raw of my search with the replace command and was wondering if wildcards are available.</P> <P>My data looks something like: BlahBlah <B>M4550G</B>ImportantStuffi<BR /> I'm trying to replace "M4550G" with the empty string.</P> <P>Is this possible? The string "M4550G" can have any numbers but the M and G will always be there.</P> Tue, 20 Jan 2015 22:57:23 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-remove-a-string-from-raw-in-a-search-using/m-p/196318#M56609 rlough 2015-01-20T22:57:23Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-remove-a-string-from-raw-in-a-search-using/m-p/196319#M56610 <P>I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:</P> <PRE><CODE>[your search] | rex field=_raw mode=sed "s/M4450G//g" </CODE></PRE> Tue, 20 Jan 2015 23:05:58 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-remove-a-string-from-raw-in-a-search-using/m-p/196319#M56610 chanfoli 2015-01-20T23:05:58Z