What is the difference in total and Total?

[emilynicole73]

index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -total | head 10

So if I change Total to total, I get different results. Which one would be the correct?

[richgalloway]

'Total' and 'total' are completely different fields. They cannot be used interchangeably. 'Total' is one result produced by the second stats command. 'total' is null as it not a result from stats. You probably want 'Total'.

[dmarling]

You are getting different results because you are applying a sort to a nonexistent field when Total is capitalized and then doing a head 10. The sort is not being applied with a capital "Total" field so you get a different first 10 results with a head 10 than when you sort in descending order with a lower case total. There is nothing wrong or right here, it's just a mistake in your query due to case sensitivity of field names in Splunk.

It would match if you made it this:

index="YOURINDEX" |stats count by domain, id.orig_h | sort -count |stats list(domain) as Domain, list(count) as count sum(count) as Total by id.orig_h |sort -Total | head 10

[vnravikumar]

Hi

Field names are always case sensitive, please check.