Things like ingest actions or even the new edge processor could this this.  However, one thing Id recommend if these fields are always null values in every event is that you can remove them from being being sent in the first place using log filters on the palo cortex side.  You can pick and chose what fields are included in the HTTP export that is sent to Splunk.     https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/create-log-filters#id45d692f3-6f90-4a7c-bd2d-a8dc385fbf76 ... View more