https://community.splunk.com/t5/Splunk-Search/eval-if-len-substr-to-produce-specific-results/m-p/488411#M136445 <P>@noob4now,</P> <P>Try using nested if</P> <PRE><CODE>| eval Port=if(match(Port,"Ethernet"),if(len(Port)&gt;=22,substr(Port,1,len(Port)-2),Port),Port) </CODE></PRE> Sat, 21 Sep 2019 08:46:42 GMT renjith_nair 2019-09-21T08:46:42Z https://community.splunk.com/t5/Splunk-Search/eval-if-len-substr-to-produce-specific-results/m-p/488410#M136444 <P>So far, I've had success with the following command:<BR /> eval Port=if(len(Port)&gt;=22,substr(Port,1,len(Port)-2),Port)<BR /> This checks to see if a Sport result is &gt;= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result. </P> <P>The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...</P> <P>I'm thinking it should start with:<BR /> eval Port=if(Port="Ethernet%" &lt;--- from here, I'm a bit lost on how to put it together with the above statement.</P> Fri, 20 Sep 2019 14:25:37 GMT https://community.splunk.com/t5/Splunk-Search/eval-if-len-substr-to-produce-specific-results/m-p/488410#M136444 noob4now 2019-09-20T14:25:37Z https://community.splunk.com/t5/Splunk-Search/eval-if-len-substr-to-produce-specific-results/m-p/488411#M136445 <P>@noob4now,</P> <P>Try using nested if</P> <PRE><CODE>| eval Port=if(match(Port,"Ethernet"),if(len(Port)&gt;=22,substr(Port,1,len(Port)-2),Port),Port) </CODE></PRE> Sat, 21 Sep 2019 08:46:42 GMT https://community.splunk.com/t5/Splunk-Search/eval-if-len-substr-to-produce-specific-results/m-p/488411#M136445 renjith_nair 2019-09-21T08:46:42Z