topic Re: random() function not working in Deployment Architecture

random() function not working

Jason — Tue, 05 Oct 2010 04:12:38 GMT

I'm trying to pull a random item from a set of splunk data, so to test I have set up this simple search:

However, when I run it over a constant time period (no new events arriving), I always end up with the same component and Random number. The list of components pre-eval/sort/head is anywhere from 2-30 depending on the time range. Is this broken?

Tested on standard Splunk 4.1.2, 4.1.3, 4.1.4, 4.1.5 on Linux64/Ubuntu 8.04 LTS.

Re: random() function not working

sideview — Tue, 05 Oct 2010 06:00:39 GMT

Nothing looks wrong there. And i just created this in my instance to test it and it works fine.

Does the search language work fine when you do it manually (without any macro)? Are you sure there are more than two events on the left hand side?

Re: random() function not working

Lowell — Wed, 06 Oct 2010 00:28:38 GMT

I think the randomizer seed is based on _time of the event. I think I heard that at Splunk .Conf 2010 in one of the sessions; but I could be remembering incorrectly.

Re: random() function not working

Jason — Wed, 06 Oct 2010 04:51:29 GMT

Even still, shouldn't a randomizer be random and not a repeatable hash value?

Re: random() function not working

Jason — Wed, 06 Oct 2010 21:50:57 GMT

Re: random() function not working

Jason — Wed, 06 Oct 2010 22:31:52 GMT

Tested and repeated same behavior on same server, version 4.1.5, 4.1.3, 4.1.2. Submitted to support to test on other Linux servers, case 49146.

Re: random() function not working

Jason — Tue, 12 Oct 2010 20:49:04 GMT

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.

Bug SPL-34570 filed and support says will be fixed in 4.1.6.

Re: random() function not working

Jason — Tue, 12 Oct 2010 20:54:54 GMT

Original post was about a search macro including randomization. The problem turned out to be with the random() function itself on the box, so I edited the original post.