https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550287#M156155 <P>Are you always trying to get everything apart from the last two characters?</P><LI-CODE lang="markup">| eval part=substr(field,1,len(field)-2)</LI-CODE> Mon, 03 May 2021 22:22:35 GMT ITWhisperer 2021-05-03T22:22:35Z https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550284#M156153 <P>I'm trying to use a case statement and assign part of a field for each case statement. For example case(len(field)=5, regex that takes the first 3 characters of field, len(field=7), regex takes the first 5 characters,...)</P> Mon, 03 May 2021 22:00:46 GMT https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550284#M156153 klim 2021-05-03T22:00:46Z https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550287#M156155 <P>Are you always trying to get everything apart from the last two characters?</P><LI-CODE lang="markup">| eval part=substr(field,1,len(field)-2)</LI-CODE> Mon, 03 May 2021 22:22:35 GMT https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550287#M156155 ITWhisperer 2021-05-03T22:22:35Z https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550291#M156157 <P>no that was just a coincidence but i think you provided the answer. Substr will do since each different length I want a substring of the field and it can be used in the case statement. Thanks</P> Mon, 03 May 2021 22:34:30 GMT https://community.splunk.com/t5/Splunk-Search/Case-statement-with-a-regex/m-p/550291#M156157 klim 2021-05-03T22:34:30Z