Splunk Search

Why do these seemingly identical searches return different results when sorted?

CarbonCriterium
Path Finder

I have four versions of a nearly identical search.  The last one returns a completely different result.  What is it about the interaction of the "sort" and "head" commands that changes the outcome?

 

 

...| stats sum(eval(sc_bytes/1073741824)) AS Gigabytes by cs_uri_stem | sort -sc_bytes
...| stats sum(eval(sc_bytes/1073741824)) AS Gigabytes by cs_uri_stem | sort -Gigabytes
...| stats sum(eval(sc_bytes/1073741824)) AS Gigabytes by cs_uri_stem | sort -Gigabytes | head 100
...| stats sum(eval(sc_bytes/1073741824)) as Gigabytes by cs_uri_stem | sort -sc_bytes | head 100

 

 

 

Labels (2)
0 Karma
1 Solution

Nisha18789
Builder

hi @CarbonCriterium , can you try this once and see it that helps

 

..| stats sum(sc_bytes) as bytes by cs_uri_stem | eval Gigabytes=bytes/1073741824|sort - Gigabytes | head 100

View solution in original post

Nisha18789
Builder

Hi @CarbonCriterium , in the last query 

..| stats sum(eval(sc_bytes/1073741824)) as Gigabytes by cs_uri_stem | sort -sc_bytes | head 100

below sort will do nothing as the field used for sorting does not exist in the result

...| sort -sc_bytes

and below is taking 100 results (after the stats command) from the top 

....| head 100

Are you seeing any different behavior?  

0 Karma

CarbonCriterium
Path Finder

The head command appears to work correctly, but the results do not match up.  In the attached screenshot the values that have the greatest value in GB do not have the greatest value in Bytes.  

0 Karma

Nisha18789
Builder

hi @CarbonCriterium , can you try this once and see it that helps

 

..| stats sum(sc_bytes) as bytes by cs_uri_stem | eval Gigabytes=bytes/1073741824|sort - Gigabytes | head 100

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...