@nnimbe1 You can try the below search. The reason rtrim is working only for few is that you need to specify complete string that needs to be truncated from right. You can either use the rex command or use split and mvindex to get the desired result index=linux host=* source=ps sapstasrtsrv| eval temp=split(ARGS,"_-d")|eval ARGS=mvindex(temp,0) .   ... View more