Splunk Search

Remove fixed string from multivalue field

shakermaker
Explorer

Hi,
I have a field alert which contains the following events:
“Failed Logon”
“Dropped Database”

However, sometimes the source application adds the string “Multiple - “ before it. Hence when running stats I end up with results like:
“Failed Logon” 9
Multiple - Failed Logon” 1

“Dropped Database” 2
Multiple - Dropped Database” 3

I am looking for way to remove the string “Multiple - ” from the event field. The results should look like
“Failed Logon” 10
“Dropped Database” 5

Appreciate your help!

Tags (3)
0 Karma

woodcock
Esteemed Legend

You need the replace command:

| replace "Multiple - *" with "*" in alert
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...