topic Re: Why do these seemingly identical searches return different results when sorted? in Splunk Search

Why do these seemingly identical searches return different results when sorted?

CarbonCriterium — Tue, 18 Aug 2020 21:17:51 GMT

I have four versions of a nearly identical search. The last one returns a completely different result. What is it about the interaction of the "sort" and "head" commands that changes the outcome?

Re: Why do these seemingly identical searches return different results when sorted?

Nisha18789 — Wed, 19 Aug 2020 10:32:03 GMT

Hi @CarbonCriterium , in the last query

..| stats sum(eval(sc_bytes/1073741824)) as Gigabytes by cs_uri_stem | sort -sc_bytes | head 100

below sort will do nothing as the field used for sorting does not exist in the result

...| sort -sc_bytes

and below is taking 100 results (after the stats command) from the top

....| head 100

Are you seeing any different behavior?

Re: Why do these seemingly identical searches return different results when sorted?

CarbonCriterium — Wed, 19 Aug 2020 13:36:30 GMT

The head command appears to work correctly, but the results do not match up. In the attached screenshot the values that have the greatest value in GB do not have the greatest value in Bytes.

Re: Why do these seemingly identical searches return different results when sorted?

Nisha18789 — Wed, 19 Aug 2020 14:15:48 GMT

hi @CarbonCriterium , can you try this once and see it that helps

..| stats sum(sc_bytes) as bytes by cs_uri_stem | eval Gigabytes=bytes/1073741824|sort - Gigabytes | head 100