Your string ":: ::: ::::" has white spaces which I suspect are causing you grief. Remove the white spaces between the various groups of ":" that you have in your string and then try something like this.
| eval _raw = replace (_raw," +","=")
This worked for me when I had to remove an unknown quantity of white spaces, but only when grouped at 4 or more white spaces. So for you a double eval may work best but might not be the most optimal solution if your regex skills are advanced enough.
| eval _raw = replace (_raw,": :","::")
| eval _raw = replace (_raw,"::+",":")
You will want to use the eval command.
your_search | eval new_location = replace(Location, ":+",":")|more_your_search
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions
field names are case sensitive. what value does "op" have? It should be |eval op = one.":".two.":".three.":".four|
I am running this query, but there is no change :
index="maa" | rex field="Location" (?
You could try: eval Location=replace(Location,":*",":")
, if that doesn't work, could you post some sanatized data to look at?
but it is not coming, my multiple : is not getting replaced