Interesting fields count and percentage incorrect

[benwebsternucle]

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value.

I am seeing the top values that the returned events have, but the count and percent is wrong.

My search returns 135 events, when I click on the result field, I am shown a row for each of the values:

I have never seen more than 100% displayed in the % column of this pop out menu.

Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this.

Thanks

[jeffland · Accepted solution]

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.