Splunk Search

Is there an easy way to remove a section of string from a field?

SMM10
Explorer

I want to get an alert and run it but there are items I wanted to remove.

 

| rest "/servicesNS/-/-/saved/searches"
| search title="SomeAlert"
| fields qualifiedSearch

 

So far I am able to get my search but there is a line in there I want to remove, and then display my result. For example if the following was a line in qualifiedSearch.

 

| rename test1 as test, rename operation1 as operation

 

Is there an easy way I can use rex or something else to find this string in qualifiedSearch and remove it?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval search=[| rest splunk_server=local /servicesNS/-/-/saved/searches | where title="SomeAlert" | fields qualifiedSearch | rename qualifiedSearch as query | format "" "" "" "" "" ""]
| eval search=replace(search,"\| rename test1 as test, rename operation1 as operation", "")
| map search="| makeresults | map search="$search$

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval search=[| rest splunk_server=local /servicesNS/-/-/saved/searches | where title="SomeAlert" | fields qualifiedSearch | rename qualifiedSearch as query | format "" "" "" "" "" ""]
| eval search=replace(search,"\| rename test1 as test, rename operation1 as operation", "")
| map search="| makeresults | map search="$search$
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...