@yuanliu  1. My task is to calculate number of events with "FAILED" value in "RESULT" key, it looks like this and it works (thanks to you guys!) - `index="myIndex" sourcetype ="mySourceType" | foreach "*DEV*" "UAT*" [| eval keep=if(isnotnull('<<FIELD>>'), 1, keep)] | where keep==1 | stats count(eval('RESULT'=="FAILED")) as FAILS | stats values(FAILS)` It would be superb to add case-insensitivity, so both `DEV` and `Develop` are included to the result 2. Many thanks, `foreach "*DEV*" "UAT*"` works as a charm! ... View more

unfortunately dataset is old and can't be changed  I'd be happy if fields have decent naming pattern..  ... View more

Sorry for the confusion - I'm new to this dataset and some topics became clear only after init search  Anyways I'm running index="myIndex" sourcetype ="mySourceType" | foreach "*PROD*" [| eval keep=if(isnotnull('<<FIELD>>'), 1, keep)] | where keep==1 to get events with `*PROD*` in field names ..and index="myIndex" sourcetype ="mySourceType" | foreach "*DEV*" [| eval keep=if(isnotnull('<<FIELD>>'), 1, keep)] | where keep==1 to get events with `*DEV*` in field names ..so no need to find events without `*PROD*` in filed name But: 1. how can I make foreach condition case-insensitive, so events with both `Production` and `PRODUCTION`  fields found?  2. how can I make foreach to search with OR condition, e.g. `foreach "*DEV*" OR "*UAT*"` ?  Many thanks in advance! ... View more

@ITWhisperer sure, sorry if it wasn't clear  I have some events that have `PROD*` in field names (e.g. `PROD error`, `Production warning`, etc.) Other events don't have `PROD*` in field names, e.g. they have `DEV error`, `Development warning`, etc. The end goal is to build dashboard that will compare statistics across different envs, that's why I need data from other fields like `ERROR_CODE` Hope it makes sense and thanks a lot for your help and patience, it's much appreciated! ... View more

` index=myIndex sourcetype=mySourceType | fields - PROD* ` still displays events with and without `PROD*` fields.. Am I doing smtg wrong?  ... View more

@ITWhisperer  Many thanks, it shows all events with `PROD*` filed names How can I get all events without `PROD*` filed names please?  ... View more

What I need to do is: Select all events that have `PROD*` in field name and calculate number of events that have `SUCCESS` value in `RESULT` field   ... View more