Hi this my search results 
         COUNTRY    avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER)
1   268647320   462.000000
2   268647324   404.000000
3   268647325   483.000000
4   268713740   90.000000
5   268755211   95.000000
6   268755212   81.000000
7   268910904   47.000000
8   ALBANIA         78.885057
9   ALGERIA         162.192308
10  ANDORRA         72.083333
11  ANGOLA          87.625000
12  ARGENTINA   131.596965
13  ARMENIA         124.333333
14  AUSTRALIA   119.199497
15  AUSTRIA         140.973917
16  AZERBAIJAN  136.800000
17  BAHAMAS         200.375000
18  BAHRAIN         102.406360
I want only countries to be displayed,i want to eliminate first numbers from COUNTRY field.
My search query is
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | table CUS_OBJID,COUNTRY,CITY,ORDER_CREATED_DATE,ORDER_END_DATE | eval j2=ORDER_END_DATE | eval j1=ORDER_CREATED_DATE | eval d1=strptime(j1,"%d-%b-%y") |eval d2=strptime(j2,"%d-%b-%y") | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER = (d2-d1)/86400 | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER=round(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER,2) |table COUNTRY,CITY,TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER | stats avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER) by COUNTRY 
Please help me
As a general tip regarding your search - you don't need the two table command you have in there.
You can get rid of the country values starting with a digit by adding a where command after your initial search command...
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...
As a general tip regarding your search - you don't need the two table command you have in there.
You can get rid of the country values starting with a digit by adding a where command after your initial search command...
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...
No problem. Please mark my answer as accepted if it solved your problem.
thanks.................
