How do I split/extract these string values to only use part of the string for a field in my search?

[RICKZHANG]

Here are some eventNames: 2022-NO_USER_IN_SESSION, 1022-DRR_INFO, ...
I need the values like: NO_USER_IN_SESSION, 1022-DRR_INFO (so eventName=NO_USER_IN_SESSION)
How to split the eventNames (2022-NO_USER_IN_SESSION, 1022-DRR_INFO)

index=app sourcetype=Epc*Event splunk_server_group=ewe sourcetype=EpcPromotionsEvent  eventName=?

[fdi01]

use regular expression to do it .

Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.

http://regexone.com/ - this is a great interactive tutorial
https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
Splunk Regular Expressions - docs are great
Regular Expression Tutorial

[richgalloway]

What are the criteria for separating eventNames?