Is it possible to hide the filed value for one index but keep it for the other index?

[MeMilo09]

Hey Guys, 

I am new to Splunk, and want to know if there is an easy way of hiding the value of one filed from one index but keeping it on the other. Both indexes have the same field devApp and color.  I tried NOT and and also color!=blue  that removes the entire event coming from the oranges index. I need both events from both indexes. How can I remove the color filed value from the devApp=XML, while still including the event?

(index = "oranges"  (devApp=XML color!=blue)  OR  (devApp=HMTL color=blue))

[richgalloway]

The search command

(index = "oranges"  (devApp=XML color!=blue)  OR  (devApp=HMTL color=blue))

tells Splunk you want to fetch all events from the "oranges" index with the specified criteria.  Events are always fetched in their entirety.  Anything you want or need to do with individual fields must be done with other commands.

We can't remove individual fields, but we can override them.  Like this:

(index = "oranges"  (devApp=XML color!=blue)  OR  (devApp=HMTL color=blue))
| eval color=if(devApp=XML,null,color)