Splunk Search

Is it possible to remove a string from _raw in a search using wildcards with the replace command?

rlough
Path Finder

Hello,

I'm trying to remove a string from the _raw of my search with the replace command and was wondering if wildcards are available.

My data looks something like: BlahBlah M4550GImportantStuffi
I'm trying to replace "M4550G" with the empty string.

Is this possible? The string "M4550G" can have any numbers but the M and G will always be there.

Tags (3)
1 Solution

chanfoli
Builder

I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:

[your search] | rex field=_raw mode=sed "s/M4450G//g"

View solution in original post

chanfoli
Builder

I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:

[your search] | rex field=_raw mode=sed "s/M4450G//g"
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...