title: Splunk: Removing all text after a specific string in a column
body: <p>I have a field where all values have the following format:</p>
  
  <p>Knowledge:xyz,id:2907129</p>
  
  <p>The id number always changes, however, all I want is the value of xyz.</p>
  
  <p>I used the following to remove "Knowledge:"e</p>
  
  <pre><code>eval url=replace (url, "Open_KnowledgeZone:", "") 
  </code></pre>
  
  <p>For the id portion, using ",id*" did not work within the eval replace function.</p>