Delete redundant information in fields

[caplog]

Hallo,

I would like to investigate the login behaviour of users. I use this search:

I receive the following example log:

The "abstract" function creates the field "Kontoname". This contains the following values:

The values "Machine01p", "Machine02p", "Machine03p" are double information. How can I remove or exclude these values?

Many thanks for the support!

[caplog · Accepted solution]

Solution: https://community.splunk.com/t5/Splunk-Search/Remove-host-name-in-Account-Name-field/m-p/468027