SEDCMD help

[pavanbmishra]

We have below CEF logs coming in from the device where few field doesn't have any value like cs2 below

CEF:0|vendor|product|1.1.0.15361|6099|DirectoryAssetSyncSucceeded|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=16699 cs3label=AssetName cs3=ABC.LOCAL AD cn3label=AssetPartitionId cn3=7 cs4label=AssetPartitionName cs4=XYZ.LOCAL partition cs5label=TaskId cs5=9ec9aa87-61b9-11ec-926f-3123456edt

How can we assign 'NULL' value to such field using SEDCMD or any other possible way here?

[richgalloway]

Perhaps this will get you started.

SEDCMD-csNULL = s/(c[sn]\d)=\s+(c[sn]\dlabel)/$1=NULL $2/g