I have a form, which has a text field for users to enter the orderid. users can enter in lower case or upper case. The OrderID is stored in upper case in splunk. so I want to change the input text field to upper case and perform the search. Below is my search query index=<myindex> sourcetype="mysource" (SERVICE="ORDERS" AND ORDERID=*$OrderID$* )| stats count Below is the dashboard text field <input type="text" token="OrderNumber" searchWhenChanged="true"> <label>Check Status of an Order or EXTID</label> </input> i tried changing the query to index=<myindex> sourcetype="mysource" (SERVICE="ORDERS" AND ORDERID=*upper($OrderID$)* )| stats count but that didnt work. Any help is appreciated. Thanks in Advance ... View more

I am trying to get the count of events where the transaction duration is above the average duration and below the average duration. below is my search to find out the count of events above the average transaction duration: index=whatever* sourcetype="Source" "COMPONENTNAME=X" AND "EVENT=Received"|eval receivedtime=SERVER_TIME |join type=inner ORDERNUMBER max=0[search index=tas_prod sourcetype="TAS:FUSION:ProdSupport:PRD:AuditDB" "COMPONENTNAME=Y" AND "EVENT=Delivered"|eval deliveredTime=SERVER_TIME ]|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt is it possible to get the count of transactions with diff < Avg in the same search? like: searchStatement|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt | where diff < Avg |stats count as Lsr please let me know if i can combine the count without using the same search statement another time to find the count for less than average ... View more