The answer here is NOT to change the field extractions of the original, raw data. It sounds like you want to treat the value of u_cr differently for some values of event than those from other values of event. In that case, you could just change the value of u_cr for those events dynamically at search time to get what you need. For example, if you were summing u_cr but wanted to exclude the value of u_cr from that summation for events where the event field equals "vil", you could just set u_cr to zero for those events right in the search; for example:
... | eval u_cr=if(event="vil", 0, u_cr) | stats sum(u_cr)
I hope that helps.
... View more