Splunk Enterprise

why does some of the fields in the SH starts with #

rajneeshdba
Explorer

why does some of the fields in the SH starts with # , and others not .

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

The # sign represents numeric fields which can be used in stats to calculate an aggregate value whereas the a symbol represents alphanumeric and cannot have its values calculated by a stats command

Example:

If you have a numeric field called duration, you can do this

| stats avg(duration)

If its alphanumeric, you will not get a value returned from stats

0 Karma

ddrillic
Ultra Champion

The ones with # are numerical fields.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...