Splunk Search

how to stats count case-insensitively?

Path Finder

i have a case to count db operations. in the log file, the format is like:

[time1] op=select data=....
[time2] op=SELECT data=....
...

i can count each operation by the search "index=db | stats count by op". but "select" and "SELECT" are counted as two different ops, so, how to treat them as the same one?

Tags (2)
1 Solution

Path Finder

just found the "eval" command to handle this.

index=db | eval op=upper(op) | stats count by op

View solution in original post

Path Finder

just found the "eval" command to handle this.

index=db | eval op=upper(op) | stats count by op

View solution in original post