Answer by warren for Splunk query(SPL). Replace a value or anything that comes after the value until a special character

Use an eval replace()

It’s still regex based, but simpler to understand (and, often, faster to run) than rex mode=sed:

| eval myfield=replace(myfield,"e2_quote_policy_ask_zipcode[^\/]+","AskZipcode")

from User warren – Stack Overflow https://stackoverflow.com/questions/76784785/splunk-queryspl-replace-a-value-or-anything-that-comes-after-the-value-until/76805109#76805109
via IFTTT