Splunk: Removing all text after a specific string in a column

I have a field where all values have the following format:

Knowledge:xyz,id:2907129

The id number always changes, however, all I want is the value of xyz.

I used the following to remove "Knowledge:"e

eval url=replace (url, "Open_KnowledgeZone:", "")

For the id portion, using ",id*" did not work within the eval replace function.

Solution

You'll want to use a regex. Something like:

rex field=url "(?<=Knowledge:)(?<AnyFieldName>.*)(?=,)"

Where <AnyFieldName> is the name you want the result field to be. This will select all characters after "Knowledge:" and before the ",".

Here is the regex in action outside of Splunk: