i have a case to count db operations. in the log file, the format is like:
[time1] op=select data=....
[time2] op=SELECT data=....
...
i can count each operation by the search "index=db | stats count by op". but "select" and "SELECT" are counted as two different ops, so, how to treat them as the same one?
just found the "eval" command to handle this.
index=db | eval op=upper(op) | stats count by op
just found the "eval" command to handle this.
index=db | eval op=upper(op) | stats count by op