https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699556#M237476 <LI-CODE lang="markup">| eval id=random() | sort 0 id | streamstats count as id | eval group=((id - 1)%5) + 1 | stats list("Display Name") as "Display Name" by group</LI-CODE> Thu, 19 Sep 2024 11:12:38 GMT ITWhisperer 2024-09-19T11:12:38Z https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699541#M237467 <P>Morning All&nbsp;</P><P>I am trying to work out how to use splunk spl to pick random names from a list</P><P>i have 1 field called 'displayName'. there are over 200 entries and i'd like to use Splunk to pick 5 random names&nbsp;</P><P>&nbsp;</P><P>appreciate help in this</P><P>Paula&nbsp;&nbsp;</P><P>&nbsp;</P> Thu, 19 Sep 2024 10:02:25 GMT https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699541#M237467 PaulaCom 2024-09-19T10:02:25Z https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699551#M237472 <P>If your values are in a multi-value field, you can do something like this</P><LI-CODE lang="markup">| eval choice=mvindex(displayName, random()%200)</LI-CODE><P>If the names are in separate events, you could do something like this</P><LI-CODE lang="markup">| eval id=random()%500 | sort 0 id | head 5</LI-CODE> Thu, 19 Sep 2024 11:07:11 GMT https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699551#M237472 ITWhisperer 2024-09-19T11:07:11Z https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699553#M237474 <P>i've looked at similar search online and have come up with this</P> <LI-CODE lang="markup">| table "Display Name" | eval "group" = (random() % 2) +1 | stats list("Display Name") as "Display Name" by "group"</LI-CODE> <P>this is returning random names in two groups<BR />&nbsp; &nbsp; &nbsp;&nbsp;</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">group</TD> <TD width="50%">display Name</TD> </TR> <TR> <TD>1</TD> <TD> <P>joe blogs 5</P> <P>joe blogs 2</P> <P>joe blogs&nbsp; 6</P> </TD> </TR> <TR> <TD>2</TD> <TD> <P>joe blogs 7</P> <P>joe blogs 8</P> <P>joe blogs&nbsp; 12</P> </TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>Any ideas how i can set the number returning for each group? maybe using the limit function???</P> <P>&nbsp;</P> Thu, 19 Sep 2024 17:07:04 GMT https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699553#M237474 PaulaCom 2024-09-19T17:07:04Z https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699555#M237475 <P>thank&nbsp; you the second option works for what i need</P><P>&nbsp;</P> Thu, 19 Sep 2024 11:12:02 GMT https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699555#M237475 PaulaCom 2024-09-19T11:12:02Z https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699556#M237476 <LI-CODE lang="markup">| eval id=random() | sort 0 id | streamstats count as id | eval group=((id - 1)%5) + 1 | stats list("Display Name") as "Display Name" by group</LI-CODE> Thu, 19 Sep 2024 11:12:38 GMT https://community.splunk.com/t5/Splunk-Search/using-spl-to-pick-random-names-from-list/m-p/699556#M237476 ITWhisperer 2024-09-19T11:12:38Z