it is working now thanks I figured out the issue single quotes are working and the query is taking a long time retrieve the data in splunk ... View more

I'm not sure if it will get you what you need, but you can wrap an eval inside of a stats function. count(eval(team=$team$ AND project=*)) ... View more