Deployment Architecture
Highlighted

random() function not working

Motivator

I'm trying to pull a random item from a set of splunk data, so to test I have set up this simple search:

index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 1

However, when I run it over a constant time period (no new events arriving), I always end up with the same component and Random number. The list of components pre-eval/sort/head is anywhere from 2-30 depending on the time range. Is this broken?

Tested on standard Splunk 4.1.2, 4.1.3, 4.1.4, 4.1.5 on Linux64/Ubuntu 8.04 LTS.

Tags (2)
Highlighted

Re: random() function not working

SplunkTrust
SplunkTrust

Nothing looks wrong there. And i just created this in my instance to test it and it works fine.

Does the search language work fine when you do it manually (without any macro)? Are you sure there are more than two events on the left hand side?

0 Karma
Highlighted

Re: random() function not working

Motivator

Original post was about a search macro including randomization. The problem turned out to be with the random() function itself on the box, so I edited the original post.

0 Karma
Highlighted

Re: random() function not working

Super Champion

I think the randomizer seed is based on _time of the event. I think I heard that at Splunk .Conf 2010 in one of the sessions; but I could be remembering incorrectly.

0 Karma
Highlighted

Re: random() function not working

Motivator

Even still, shouldn't a randomizer be random and not a repeatable hash value?

0 Karma
Highlighted

Re: random() function not working

Motivator

A good search to use when testing (should work on any Splunk) is index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 2

0 Karma
Highlighted

Re: random() function not working

Motivator

Tested and repeated same behavior on same server, version 4.1.5, 4.1.3, 4.1.2. Submitted to support to test on other Linux servers, case 49146.

0 Karma
Highlighted

Re: random() function not working

Motivator

Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.

Bug SPL-34570 filed and support says will be fixed in 4.1.6.

View solution in original post