Archive
Highlighted

Other interesting fields

Splunk Employee
Splunk Employee

How does Splunk determine which fields to add to "other interesting fields"?

Tags (1)
Highlighted

Re: Other interesting fields

SplunkTrust
SplunkTrust

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

View solution in original post

Highlighted

Re: Other interesting fields

Splunk Employee
Splunk Employee

So the minFrequency is based on what? The module doc displays only..
minFrequency
(no description available)

Default value: 0.2

0 Karma
Highlighted

Re: Other interesting fields

SplunkTrust
SplunkTrust

oh. hehe. I'm sorry i should have skimmed the docs first before sending. minFrequency means the frequency with which the field appears across the events. So at 0.2, it'll screen out any fields that are only in <20% of the events.

0 Karma