Splunk Search

Interesting fields count and percentage incorrect

benwebsternucle
Engager

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value.

I am seeing the top values that the returned events have, but the count and percent is wrong.

My search returns 135 events, when I click on the result field, I am shown a row for each of the values:

alt text

I have never seen more than 100% displayed in the % column of this pop out menu.

Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this.

Thanks

Tags (1)
1 Solution

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

View solution in original post

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...