What do you mean by "the field abcd is already extracted"? Remember that most of the fields you work with in Splunk are so called "search-time" extractions which means that they are extracted dynamically when you are searching and displaying the data while SEDCMD works in so called "index-time" which means _before_ the data is written to Splunk's indexes. SEDCMD as @richgalloway pointed out does not know anything about the search-time extracted fields so you can't rely on their values. SEDCMD is a regex-based text substitution which works on the _raw data. There is no concept of field here whatsoever. ... View more