Splunk Dev

Is there a function that randomly shuffles results?

davidch12
Explorer

Similar to sort, except I'm looking for a function to randomly shuffle the results. This achieves the same result as the Linux shuf command.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

 ... | eval _random=random()
 | sort 0 _random

Or this:

 ... | eval _random=md5(_raw)
 | sort 0 _random

davidch12
Explorer

Looks like the "0" argument to sort ensures all results are returned, even if the number is greater than 10,000:
https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Sort

Is my interpretation correct?

0 Karma

woodcock
Esteemed Legend

Yes, this is very important; never run sort without a number.

0 Karma

martinpu
Communicator

Hi,

how about something like this?

index=yourIndex
| eval randomValue=random()
| sort randomValue
| table _time _raw randomValue
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...