Field categorization

[KarunK]

Hi All,

A quick question reagrding the symbols "#" and "a" (alpha I believe), on the left hand side of a filed name in "selected fields" and "interesting fields".

How is this categorized ? Is it based on the field type alphanumeric and numeric. But this is not consistent ?

Any idea ?

Thanks

Regards

KK

[dmr195 · Accepted solution]

It would appear that fields are considered numeric if more than half of the field values are numeric.

The bit of code that decides is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/field_summary.js:

    // treat as numeric if HALF or more of the occurences are considered numeric
    var isNumeric = (parseInt(fieldNode.attr("nc"), 10) > this.eventCount/2);

If you want to see what proportion of field values are numeric for your search, click the "i" button to display the search job inspector, then scroll right to the bottom of it and click the "field_summary" link. In the field summary, you'll see lines similar to:

  <field k="date_hour" c="86275" nc="86275" dc="24" exact="1" relevant="0">

The "c" attribute is telling you the total count and the "nc" field is telling you the numeric count, so if nc>c/2 then the field will be considered numeric.

[koshyk]

superb concise answer.

[KarunK]

Thanks for that. really helpful.