topic Re: Is there a function that randomly shuffles results? in Splunk Dev

Is there a function that randomly shuffles results?

davidch12 — Mon, 01 Apr 2019 18:43:26 GMT

Similar to sort, except I'm looking for a function to randomly shuffle the results. This achieves the same result as the Linux shuf command.

martinpu — Mon, 01 Apr 2019 19:13:05 GMT

Hi,

how about something like this?

index=yourIndex
| eval randomValue=random()
| sort randomValue
| table _time _raw randomValue

woodcock — Mon, 01 Apr 2019 19:49:57 GMT

Like this:

 ... | eval _random=random()
 | sort 0 _random

Or this:

 ... | eval _random=md5(_raw)
 | sort 0 _random

davidch12 — Mon, 01 Apr 2019 21:27:18 GMT

Looks like the "0" argument to sort ensures all results are returned, even if the number is greater than 10,000:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Sort

Is my interpretation correct?

woodcock — Mon, 01 Apr 2019 21:53:47 GMT

Yes, this is very important; never run sort without a number.

kelstahl8705 — Tue, 23 Jul 2024 12:45:08 GMT

I have to look up this command every few months because I can never remember it... Are you talking about the 'scrub' command? Turns your search results from

email= thisemail@gmail.com > email= fjnwspfvj@gmail.com or possibly to >
email= dspehbpwn@smrls.dpo

It keeps the data in the same format just jumbles everything up?

https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/SearchReference/Scrub
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Scrub