Splunk Search

Interesting fields count and percentage incorrect

benwebsternucle
Engager

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value.

I am seeing the top values that the returned events have, but the count and percent is wrong.

My search returns 135 events, when I click on the result field, I am shown a row for each of the values:

alt text

I have never seen more than 100% displayed in the % column of this pop out menu.

Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this.

Thanks

Tags (1)
1 Solution

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

View solution in original post

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...