Splunk Search

Interesting fields count and percentage incorrect

benwebsternucle
Engager

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value.

I am seeing the top values that the returned events have, but the count and percent is wrong.

My search returns 135 events, when I click on the result field, I am shown a row for each of the values:

alt text

I have never seen more than 100% displayed in the % column of this pop out menu.

Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this.

Thanks

Tags (1)
1 Solution

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

View solution in original post

jeffland
Champion

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...