Is it possible to remove a string from _raw in a search using wildcards with the replace command?

[rlough]

Hello,

I'm trying to remove a string from the _raw of my search with the replace command and was wondering if wildcards are available.

My data looks something like: BlahBlah M4550GImportantStuffi
I'm trying to replace "M4550G" with the empty string.

Is this possible? The string "M4550G" can have any numbers but the M and G will always be there.

[chanfoli · Accepted solution]

I am not sure that replace could do this well given that we are talking about scanning the entire raw event. You could however use rex in sed mode to replace the string at search time, you could also use a sed transform at index time which might help search performance if your _raw fields are large and you notice a performance impact:

[your search] | rex field=_raw mode=sed "s/M4450G//g"