Hi everyone, I have the following search: index=xyz | eval new_field = field | eval length=len(new_fied) | eval new_field = substr(new_field, 1, len(new_field) -15) | table new_field,field,length With that I'm removing the last 15 digits of "new_field"  So this query works but the problem is that my "new_field" have 4 different lenghts and for each one I need to do something different then I'd like to create a condition to extract last 15 numbers only if the lenght is 27 (one of the lenghts) sample: 011332255667799114466990033 turns out > 011332255667 I was trying to do something like below: | eval new_field = if((len(new_field)==27, "0", new_field)substr(new_field, 1, len(new_field) -15)) For sure this is not working, but just to show my idea and what I need to accomplish. When the "new_field" has <> 27 digits it goes wrong Any idea? Thanks ... View more