index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -total | head 10
So if I change Total to total, I get different results. Which one would be the correct?
'Total' and 'total' are completely different fields. They cannot be used interchangeably. 'Total' is one result produced by the second stats
command. 'total' is null as it not a result from stats
. You probably want 'Total'.
You are getting different results because you are applying a sort to a nonexistent field when Total is capitalized and then doing a head 10. The sort is not being applied with a capital "Total" field so you get a different first 10 results with a head 10 than when you sort in descending order with a lower case total. There is nothing wrong or right here, it's just a mistake in your query due to case sensitivity of field names in Splunk.
It would match if you made it this:
index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -Total | head 10
Hi
Field names are always case sensitive, please check.