If you don't know the index of the field you're trying to manipulate, then you can use a unique delimiter to unpack it, edit the value with string manipulation functions, and then repack it: | makeresults
| eval log=split("ne,se,sw,nw", ",")
| eval old=log
| eval dlm="__".random()."__"
| eval log=mvjoin(log, dlm)
| eval log=replace(log, "n", "North-")
| eval log=replace(log, "s", "South-")
| eval log=replace(log, "e", "East")
| eval log=replace(log, "w", "West")
| eval log=split(log, dlm)
... View more