https://community.splunk.com/t5/Splunk-Enterprise-Security/I-had-a-usecase-to-remove-one-of-the-filed-Secutiry-id-value/m-p/382176#M3902 <P>Like this:</P> <PRE><CODE>... | Security_id = nullif(Security_id, "10.141.20.19") </CODE></PRE> Thu, 11 Jul 2019 05:50:31 GMT woodcock 2019-07-11T05:50:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/I-had-a-usecase-to-remove-one-of-the-filed-Secutiry-id-value/m-p/382175#M3901 <P>I had a usecase to remove one of the filed(Secutiry_id) value WHEN IP address is 10.141.20.19.Can you guys help in framing the query</P> Tue, 09 Jul 2019 15:33:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/I-had-a-usecase-to-remove-one-of-the-filed-Secutiry-id-value/m-p/382175#M3901 Manoj1988 2019-07-09T15:33:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/I-had-a-usecase-to-remove-one-of-the-filed-Secutiry-id-value/m-p/382176#M3902 <P>Like this:</P> <PRE><CODE>... | Security_id = nullif(Security_id, "10.141.20.19") </CODE></PRE> Thu, 11 Jul 2019 05:50:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/I-had-a-usecase-to-remove-one-of-the-filed-Secutiry-id-value/m-p/382176#M3902 woodcock 2019-07-11T05:50:31Z