How to remove first 8 numbers of a field

[adrianrepublic]

I have a set of devices that are identified by a very long 15 number.

The first 8 numbers are just a prefix which we would like to hide and only display last 7 numbers

867723030939341 is an example

index=index1 sourcetype=devices | stats count by device....

Is there a ay to rem

[adrianrepublic]

Worked a treat!

[inventsekar]

Hi @adrianrepublic 

| makeresults | eval device=867723030939341 
|rex field=device "\d{8}(?<deviceid>.*)"
| table device deviceid

[ITWhisperer · Accepted solution]

| rex field=device mode=sed "s/^\d{8}//g"

or

| eval device=substr(device,9)