Similar to sort, except I'm looking for a function to randomly shuffle the results. This achieves the same result as the Linux shuf command.
sort
shuf
I have to look up this command every few months because I can never remember it... Are you talking about the 'scrub' command? Turns your search results fromemail= [email protected] > email= [email protected] or possibly to >email= [email protected] It keeps the data in the same format just jumbles everything up?https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/SearchReference/Scrubhttps://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Scrub
Like this:
... | eval _random=random() | sort 0 _random
Or this:
... | eval _random=md5(_raw) | sort 0 _random
Looks like the "0" argument to sort ensures all results are returned, even if the number is greater than 10,000: https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/Sort
Is my interpretation correct?
Yes, this is very important; never run sort without a number.
Hi,
how about something like this?
index=yourIndex | eval randomValue=random() | sort randomValue | table _time _raw randomValue
