How to remove closing bracket "]" from my data?

[R_M]

Data looks like  src:10.124.4.151]

and i want to remove this bracket and data should look like 10.124.4.151

I am try SED and regex  but unable to solve. 

Kindly help

[VatsalJagani]

@R_M - Try rtrim function.

<your query>
| eval field_name=rtrim(field_name, "]")

I hope this helps!!!

[isoutamo]

Hi

I'm supposing that you are doing this on search time? Then one option is use

... <your base query> 
| rex "src:(?<src>[^\]]+)"