Thanks - that helped a lot. One note: At least since Splunk 7.x you can use `trim` instead of `rex`: ... | foreach Every Field That Might Be Empty or Have Only Whitespace Listed Here [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(trim(<<FIELD>>))==0, "0", <<FIELD>>) ] Also, in case you want to apply it for all fields, you can use `*`: ... | foreach * [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(trim(<<FIELD>>))==0, "0", <<FIELD>>) ]   ... View more