Why the order of split rows change the displayed values on Kibana table visualization

[Incauto]

Im counting documents with repeated values of the field throughput_mb_range grouped by the name of an interface.

My metric is Count.
My first split row is the name of the interface with a size of 600.
My second split row is throughput_mb_range with a size of 1.

I want to display only the value that is reapeated the most per interface name.

Is this the correct configuration to do that?

I started to doubt because when I change the order of the splis rows: first throughput_mb_range, and second row interface name, the values displayed in the table change.

[dosant (Anton Dosov)]

Hi @Incauto

It is expected that results are different.

Second split row creates a sub-aggregation

Bucket aggregations, as opposed to metrics aggregations, can hold sub-aggregations. These sub-aggregations will be aggregated for the buckets created by their "parent" bucket aggregation.

My first split row is the name of the interface with a size of 600.
My second split row is throughput_mb_range with a size of 1.

So in this case you get top 600 interfaces and then for each get top 1 through_mb_range per each interface

if to change the order:

In this case you get top 1 through_mb_range and then for that top 600 interfaces

Depending on your use-case you can pick the order which works for you.