https://community.splunk.com/t5/Splunk-Search/SEDCMD-help/m-p/578962#M201784 <P>Perhaps this will get you started.</P><LI-CODE lang="markup">SEDCMD-csNULL = s/(c[sn]\d)=\s+(c[sn]\dlabel)/$1=NULL $2/g</LI-CODE> Mon, 20 Dec 2021 18:30:54 GMT richgalloway 2021-12-20T18:30:54Z https://community.splunk.com/t5/Splunk-Search/SEDCMD-help/m-p/578957#M201781 <P>We have below CEF logs coming in from the device where few field doesn't have any value like cs2 below</P><P>&nbsp;</P><P><SPAN>CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt</SPAN></P><P>&nbsp;</P><P><SPAN>How can we assign 'NULL' value to such field using SEDCMD or any other possible way here?</SPAN></P> Mon, 20 Dec 2021 17:54:14 GMT https://community.splunk.com/t5/Splunk-Search/SEDCMD-help/m-p/578957#M201781 pavanbmishra 2021-12-20T17:54:14Z https://community.splunk.com/t5/Splunk-Search/SEDCMD-help/m-p/578962#M201784 <P>Perhaps this will get you started.</P><LI-CODE lang="markup">SEDCMD-csNULL = s/(c[sn]\d)=\s+(c[sn]\dlabel)/$1=NULL $2/g</LI-CODE> Mon, 20 Dec 2021 18:30:54 GMT https://community.splunk.com/t5/Splunk-Search/SEDCMD-help/m-p/578962#M201784 richgalloway 2021-12-20T18:30:54Z