my event has a field Transaction:=InpatUPMC_050_Close_WorklistLoad and i am looking to strip the InpatUPMC_050_ part
i tried the rex field=source mode=sed "s/Transaction:=InpatUPMC_050_Close_//g" but does not work.
Try replace function:
| eval source=replace(source, "Transaction:=InpatUPMC_050_Close_", "")
