Splunk Search

How do I generate a random number between a specific range?

sravani27
Path Finder

Hi, How can I generate a random number between 1 to 20. I random() function doesn't allow to specify a range. please help

Tags (1)

PickleRick
SplunkTrust
SplunkTrust

One thing - in case of small ranges it might be negligible but if you want a random number from a big range (like between 0 and 1.5*2^30) performing a modulo on random() will not give you uniform distribution.

0 Karma

gbhatti
Engager

@PickleRick I was not aware of this. Thanks for pointing it out.

0 Karma

worshamn
Contributor

Building a bit on @richgalloway 's answer I believe this works and allows you to set the high and low range. I added just some extra fluff for testing, your eval line could just look line 4 with high and low replaced with your range:

| makeresults
| eval high = 100
| eval low = 10
| eval rand = round(((random() % high)/(high)) * (high - low) + low)
| eval inRange = if(rand <= high AND rand >= low, "True", "False")

gbhatti
Engager

@worshamn Kudos! Building on your solution I slightly simplified the math.

 

...
| eval rand = random() % (high - low + 1) + low
...

 

 

woodcock
Esteemed Legend

@ppablo_splunk , this one should get moderator-answered.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the modulo operator. For example, ... | eval rand=(random() % 20) + 1 | ....

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...