https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250934#M74961 <P>Hi, try this:</P> <PRE><CODE>...| rex mode=sed field=fieldName "s/\:\d+//g" </CODE></PRE> Mon, 16 May 2016 14:06:36 GMT jkat54 2016-05-16T14:06:36Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250933#M74960 <P>I have a field that contains both IP address and port number separated by a semicolon (example 10.1.1.1:23) How do I use rex to trim off the port# leaving me with just the IP address?</P> Mon, 16 May 2016 12:46:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250933#M74960 kennyja 2016-05-16T12:46:32Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250934#M74961 <P>Hi, try this:</P> <PRE><CODE>...| rex mode=sed field=fieldName "s/\:\d+//g" </CODE></PRE> Mon, 16 May 2016 14:06:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250934#M74961 jkat54 2016-05-16T14:06:36Z https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250935#M74962 <P>if you're wanting to replace the field value, @jkat54 solution should work. Howeverm if you only want to extract the IP into a field, try this</P> <PRE><CODE>.... | rex field=_raw "(?&lt;ip&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" </CODE></PRE> <P>This rex will extract all IP address in a field called ip.</P> Mon, 16 May 2016 14:16:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-remove-everything-after-a-colon-in-an-existing-field/m-p/250935#M74962 sundareshr 2016-05-16T14:16:05Z