strip certain data from field

[MOHITJOSHI]

my event has a field Transaction:=InpatUPMC_050_Close_WorklistLoad and i am looking to strip the InpatUPMC_050_ part

i tried the rex field=source mode=sed "s/Transaction:=InpatUPMC_050_Close_//g" but does not work.

[manjunathmeti]

Try replace function:

| eval source=replace(source, "Transaction:=InpatUPMC_050_Close_", "")