Splunk Search

Is it possible to remove a string from _raw in a search using wildcards with the replace command?

rlough
Path Finder

Hello,

I'm trying to remove a string from the _raw of my search with the replace command and was wondering if wildcards are available.

My data looks something like: BlahBlah M4550GImportantStuffi
I'm trying to replace "M4550G" with the empty string.

Is this possible? The string "M4550G" can have any numbers but the M and G will always be there.

Tags (3)
1 Solution

chanfoli
Builder

I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:

[your search] | rex field=_raw mode=sed "s/M4450G//g"

View solution in original post

chanfoli
Builder

I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:

[your search] | rex field=_raw mode=sed "s/M4450G//g"
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...