https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583387#M11399 <P>case needs pair of arguments i.e. an even number of arguments, you have an odd number</P><LI-CODE lang="markup">| eval site=case(site=="SAINT MAXIMIN LA SAINTE BA", "SAINT MAXIMIN LA SAINTE BAUME", 1==1,"Unknown")</LI-CODE> Wed, 02 Feb 2022 13:09:33 GMT ITWhisperer 2022-02-02T13:09:33Z https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583378#M11398 <P>hi</P><P>splunk tells me that "the arguments to the case function are invalid"</P><P>what is wrong please?</P><P>&nbsp;</P><LI-CODE lang="markup">| eval site=case(site=="SAINT MAXIMIN LA SAINTE BA", "SAINT MAXIMIN LA SAINTE BAUME", 1)</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Wed, 02 Feb 2022 12:35:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583378#M11398 jip31 2022-02-02T12:35:05Z https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583387#M11399 <P>case needs pair of arguments i.e. an even number of arguments, you have an odd number</P><LI-CODE lang="markup">| eval site=case(site=="SAINT MAXIMIN LA SAINTE BA", "SAINT MAXIMIN LA SAINTE BAUME", 1==1,"Unknown")</LI-CODE> Wed, 02 Feb 2022 13:09:33 GMT https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583387#M11399 ITWhisperer 2022-02-02T13:09:33Z https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583388#M11400 <P>perfect thanks</P><P>last question, if I want to do the same thing with a regex, how o do please?</P> Wed, 02 Feb 2022 14:01:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/help-on-eval-case/m-p/583388#M11400 jip31 2022-02-02T14:01:31Z