topic Other interesting fields in Splunk Search

Other interesting fields

rroberts — Fri, 01 Apr 2011 22:38:43 GMT

How does Splunk determine which fields to add to "other interesting fields"?

Re: Other interesting fields

sideview — Sat, 02 Apr 2011 00:31:58 GMT

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

Re: Other interesting fields

rroberts — Sat, 02 Apr 2011 01:06:29 GMT

So the minFrequency is based on what? The module doc displays only..
minFrequency
(no description available)

Default value: 0.2

Re: Other interesting fields

sideview — Sat, 02 Apr 2011 02:45:43 GMT

oh. hehe. I'm sorry i should have skimmed the docs first before sending. minFrequency means the frequency with which the field appears across the events. So at 0.2, it'll screen out any fields that are only in <20% of the events.