Use an eval replace()
It’s still regex based, but simpler to understand (and, often, faster to run) than rex mode=sed
:
| eval myfield=replace(myfield,"e2_quote_policy_ask_zipcode[^\/]+","AskZipcode")
from User warren – Stack Overflow https://stackoverflow.com/questions/76784785/splunk-queryspl-replace-a-value-or-anything-that-comes-after-the-value-until/76805109#76805109
via IFTTT