how to stats count case-insensitively?

[William]

i have a case to count db operations. in the log file, the format is like:

[time1] op=select data=....
[time2] op=SELECT data=....
...

i can count each operation by the search "index=db | stats count by op". but "select" and "SELECT" are counted as two different ops, so, how to treat them as the same one?

[William · Accepted solution]

just found the "eval" command to handle this.

index=db | eval op=upper(op) | stats count by op