Splunk Enterprise

why does some of the fields in the SH starts with #

rajneeshdba
Explorer

why does some of the fields in the SH starts with # , and others not .

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

The # sign represents numeric fields which can be used in stats to calculate an aggregate value whereas the a symbol represents alphanumeric and cannot have its values calculated by a stats command

Example:

If you have a numeric field called duration, you can do this

| stats avg(duration)

If its alphanumeric, you will not get a value returned from stats

0 Karma

ddrillic
Ultra Champion

The ones with # are numerical fields.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...