Unquoted = case-insensitive · "Quoted" = case-sensitive · EXT* · *Sun* · field=(*A* or *B*) · | where · | count by f1,f2 · | sort · | limit · _savedtime>-24h · ↵ to run · Ctrl↵ newline