Splunk Enterprise

why does some of the fields in the SH starts with #

rajneeshdba
Explorer

why does some of the fields in the SH starts with # , and others not .

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

The # sign represents numeric fields which can be used in stats to calculate an aggregate value whereas the a symbol represents alphanumeric and cannot have its values calculated by a stats command

Example:

If you have a numeric field called duration, you can do this

| stats avg(duration)

If its alphanumeric, you will not get a value returned from stats

0 Karma

ddrillic
Ultra Champion

The ones with # are numerical fields.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...