random() function not working

[Jason]

I'm trying to pull a random item from a set of splunk data, so to test I have set up this simple search:

index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 1

However, when I run it over a constant time period (no new events arriving), I always end up with the same component and Random number. The list of components pre-eval/sort/head is anywhere from 2-30 depending on the time range. Is this broken?

Tested on standard Splunk 4.1.2, 4.1.3, 4.1.4, 4.1.5 on Linux64/Ubuntu 8.04 LTS.

[Jason · Accepted solution]

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.

Bug SPL-34570 filed and support says will be fixed in 4.1.6.

[Jason]

Tested and repeated same behavior on same server, version 4.1.5, 4.1.3, 4.1.2. Submitted to support to test on other Linux servers, case 49146.

[Jason]

A good search to use when testing (should work on any Splunk) is index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 2

[Jason]

Even still, shouldn't a randomizer be random and not a repeatable hash value?

[Lowell]

I think the randomizer seed is based on _time of the event. I think I heard that at Splunk .Conf 2010 in one of the sessions; but I could be remembering incorrectly.

[sideview]

Nothing looks wrong there. And i just created this in my instance to test it and it works fine.

Does the search language work fine when you do it manually (without any macro)? Are you sure there are more than two events on the left hand side?

[Jason]

Original post was about a search macro including randomization. The problem turned out to be with the random() function itself on the box, so I edited the original post.