HI..
can i replace the _raw data value with my default data value only for the display purpose only ??
Yes, you can.
...or if you just want to change how it's displayed, but leave the value intact if you have other things using that in your search, use fieldformat
.
... | fieldformat _raw=<yourdata>
... | eval _raw=
can you give me the command or query for doin that ??