How to remove everything before first occurrence of a character in splunk

Question

I have a string with certain formate

154787878_2582_test.txt.zip

I need to remove everything before first occurrence of - and remove 154787878_

I have tried

| eval txtFile=replace(mvindex(split(txtFile,"_"),0),"") 

Please help

Answer 1

You may use

| eval txtFile = replace(txtFile,"^[^_]*_", "")

See the regex demo

The regex matches

• ^ - start of string
• [^_]* - 0 or more chars other than _
• _ - an underscore.