Splunk Search

What is the difference in total and Total?

index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -total | head 10

So if I change Total to total, I get different results. Which one would be the correct?

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

'Total' and 'total' are completely different fields. They cannot be used interchangeably. 'Total' is one result produced by the second stats command. 'total' is null as it not a result from stats. You probably want 'Total'.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Builder

You are getting different results because you are applying a sort to a nonexistent field when Total is capitalized and then doing a head 10. The sort is not being applied with a capital "Total" field so you get a different first 10 results with a head 10 than when you sort in descending order with a lower case total. There is nothing wrong or right here, it's just a mistake in your query due to case sensitivity of field names in Splunk.

It would match if you made it this:

index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -Total | head 10

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma

Champion

Hi

Field names are always case sensitive, please check.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!