Top/lower and groupby

[skarum]

• Humio Version: Managed
• Browser Version: Edge dev and crome - does not look browser specific

When using lowercase on a field the group by results seems very reduced - also beyond the casing.

Group by on a field

Lowercase the field and group by:

I would expect the results would be almost the same (only putting upper cased values together with lowercase).

Seems to be the same issue with top()

[skarum]

I did a bit more digging and it looks like only the records that are transformed are returned. In the example above it's only the values that were uppercase before that are returned. When doing an ´upper´ instead I get all the results - except the one that was already uppercased.

[KGausel]

This should be closed by bugfix: upper and lower setting null values in some instances #3947