Thanks for responding to both of my questions, MuS ! I basically re-did the same method in my first post, and it worked the second time around. The only thing I can think of is that my regex was messed up (maybe missed the ^ at the beginning). Without permissions to view anything ( hence my other post about ownership of the conf files), I'm limited. ... View more

Here's a more generic approach: The following refinement of @martinh3's approach will remove all namespace prefixes (leaving the namespace declarations, which will simply do nothing) in one hit: rex field=_raw mode=sed "s/(<\/?)([\w\d-]+):(\w+)([ \/>])/\1\3\4/g" This will remove all namespace prefixes made up of word characters, numbers or "-". If you are simply applying this to the whole raw message, then you can actually leave out 'field=_raw' or if you have extracted your XML into a field as part of a search, the replace 'field=_raw' with 'field=yourfieldname'. ... View more