i want to ignore the text before modify and want to text after that. i want to pick from the first modify present and want entire text. it should not start from 2nd modify if present

[DataOrg]

Ex : hello how are you. pls modify the request and update. modify request cant be done and failed.

[dineshraj9 · Accepted solution]

You can use rex to update the existing field or create new field -
Example :

| makeresults | eval message="hello how are you. pls modify the request and update. modify request cant be done and failed." | rex field=message "(?<message>modify.+)"

Usage : <your search> | rex field=message "(?<modified_message>modify.+)"