help on eval case

[jip31]

hi

splunk tells me that "the arguments to the case function are invalid"

what is wrong please?

| eval site=case(site=="SAINT MAXIMIN LA SAINTE BA", "SAINT MAXIMIN LA SAINTE BAUME", 1)

[ITWhisperer]

case needs pair of arguments i.e. an even number of arguments, you have an odd number

| eval site=case(site=="SAINT MAXIMIN LA SAINTE BA", "SAINT MAXIMIN LA SAINTE BAUME", 1==1,"Unknown")

[jip31]

perfect thanks

last question, if I want to do the same thing with a regex, how o do please?