I'm trying to pull a random item from a set of splunk data, so to test I have set up this simple search:
index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 1
However, when I run it over a constant time period (no new events arriving), I always end up with the same component and Random number. The list of components pre-eval/sort/head is anywhere from 2-30 depending on the time range. Is this broken?
Tested on standard Splunk 4.1.2, 4.1.3, 4.1.4, 4.1.5 on Linux64/Ubuntu 8.04 LTS.
Nothing looks wrong there. And i just created this in my instance to test it and it works fine.
Does the search language work fine when you do it manually (without any macro)? Are you sure there are more than two events on the left hand side?
Original post was about a search macro including randomization. The problem turned out to be with the random() function itself on the box, so I edited the original post.
I think the randomizer seed is based on
_time of the event. I think I heard that at Splunk .Conf 2010 in one of the sessions; but I could be remembering incorrectly.
A good search to use when testing (should work on any Splunk) is index="_internal" | stats count by component | fields - count | eval Random=random() | sort - Random | head 2
Tested and repeated same behavior on same server, version 4.1.5, 4.1.3, 4.1.2. Submitted to support to test on other Linux servers, case 49146.
Seems to be a bug related to Ubuntu 8.04 LTS, 64 bit. Running the same search as above on an Ubuntu 9.10 server, and on Windows XP, works as expected. Support has also reported that 8.04 32 bit does not have this issue.
Bug SPL-34570 filed and support says will be fixed in 4.1.6.