Archive

Field categorization

Contributor

Hi All,

A quick question reagrding the symbols "#" and "a" (alpha I believe), on the left hand side of a filed name in "selected fields" and "interesting fields".

How is this categorized ? Is it based on the field type alphanumeric and numeric. But this is not consistent ?

Any idea ?

Thanks

Regards

KK

Tags (1)
0 Karma
1 Solution

Communicator

It would appear that fields are considered numeric if more than half of the field values are numeric.

The bit of code that decides is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/field_summary.js:

    // treat as numeric if HALF or more of the occurences are considered numeric
    var isNumeric = (parseInt(fieldNode.attr("nc"), 10) > this.eventCount/2);

If you want to see what proportion of field values are numeric for your search, click the "i" button to display the search job inspector, then scroll right to the bottom of it and click the "field_summary" link. In the field summary, you'll see lines similar to:

  <field k="date_hour" c="86275" nc="86275" dc="24" exact="1" relevant="0">

The "c" attribute is telling you the total count and the "nc" field is telling you the numeric count, so if nc>c/2 then the field will be considered numeric.

View solution in original post

Communicator

It would appear that fields are considered numeric if more than half of the field values are numeric.

The bit of code that decides is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/field_summary.js:

    // treat as numeric if HALF or more of the occurences are considered numeric
    var isNumeric = (parseInt(fieldNode.attr("nc"), 10) > this.eventCount/2);

If you want to see what proportion of field values are numeric for your search, click the "i" button to display the search job inspector, then scroll right to the bottom of it and click the "field_summary" link. In the field summary, you'll see lines similar to:

  <field k="date_hour" c="86275" nc="86275" dc="24" exact="1" relevant="0">

The "c" attribute is telling you the total count and the "nc" field is telling you the numeric count, so if nc>c/2 then the field will be considered numeric.

View solution in original post

Super Champion

superb concise answer.

0 Karma

Contributor

Thanks for that. really helpful.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!