| makeresults | eval Description="000000000</ParticipantObjectQuery></ParticipantObjectIdentificat></AuditMessage[greater than sign>" | rex field=Description "(?<Description>\d+)"
I believe you need to provide better example of values, as I don't see anything after the zeros (which portion you want to remove). If your data values are like
0000ABCand you want to change the value to
0000, then you'd do like this (in search)
..| eval fieldnamehere=replace(fieldnamehere,"^(0+)(.+)", "\1")
..| rex field=fieldnamehere mode=sed "s/^(0+)(.+)/\1/"
It took off the full result field because it has a less than and greater than sign
000000000([less than sign]/ParticipantObjectQuery[greater than sign][less than sign]/ParticipantObjectIdentification[greater than sign][less than sign]/AuditMessage[greater than sign]"