Deployment Architecture

random() function not working

Jason
Motivator

I'm trying to pull a random item from a set of splunk data, so to test I have set up this simple search:

index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 1

However, when I run it over a constant time period (no new events arriving), I always end up with the same component and Random number. The list of components pre-eval/sort/head is anywhere from 2-30 depending on the time range. Is this broken?

Tested on standard Splunk 4.1.2, 4.1.3, 4.1.4, 4.1.5 on Linux64/Ubuntu 8.04 LTS.

Tags (2)
1 Solution

Jason
Motivator

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.

Bug SPL-34570 filed and support says will be fixed in 4.1.6.

View solution in original post

Jason
Motivator

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.

Bug SPL-34570 filed and support says will be fixed in 4.1.6.

Jason
Motivator

Tested and repeated same behavior on same server, version 4.1.5, 4.1.3, 4.1.2. Submitted to support to test on other Linux servers, case 49146.

0 Karma

Jason
Motivator

A good search to use when testing (should work on any Splunk) is index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 2

0 Karma

Jason
Motivator

Even still, shouldn't a randomizer be random and not a repeatable hash value?

0 Karma

Lowell
Super Champion

I think the randomizer seed is based on _time of the event. I think I heard that at Splunk .Conf 2010 in one of the sessions; but I could be remembering incorrectly.

0 Karma

sideview
SplunkTrust
SplunkTrust

Nothing looks wrong there. And i just created this in my instance to test it and it works fine.

Does the search language work fine when you do it manually (without any macro)? Are you sure there are more than two events on the left hand side?

0 Karma

Jason
Motivator

Original post was about a search macro including randomization. The problem turned out to be with the random() function itself on the box, so I edited the original post.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...