I'm trying to use a case statement and assign part of a field for each case statement. For example case(len(field)=5, regex that takes the first 3 characters of field, len(field=7), regex takes the first 5 characters,...)
Are you always trying to get everything apart from the last two characters?
| eval part=substr(field,1,len(field)-2)
Are you always trying to get everything apart from the last two characters?
| eval part=substr(field,1,len(field)-2)
no that was just a coincidence but i think you provided the answer. Substr will do since each different length I want a substring of the field and it can be used in the case statement. Thanks