Hello I have a query that examins events can outputs how many of each level of event there are index=* eval level=lower(level) | stats count by level It works fine, but in the output there are some results that should be treated/merged level count debug 10 error 15 fatal 1 info 30 information 40 trace 2 warn 70 warning 75 'info' and 'information' are the same thing, 'warn' and 'warning' are also the same thing Is there any way to extend/modify this query to have the combined count for 'info' and 'information' in a single result, and the same for 'warn' and 'warning' ? Something lik this ? level count debug 10 error 15 fatal 1 info 70 trace 2 warn 145 Many thanks _scott
... View more