Splunk Search

Interesting fields count and percentage incorrect

benwebsternucle
Engager

I have encountered a strange issue when clicking on an "interesting field" in the left side bar under the events tab, usually the pop out menu would show me up to 10 values, along with a count and percentage of the events returned which have the value.

I am seeing the top values that the returned events have, but the count and percent is wrong.

My search returns 135 events, when I click on the result field, I am shown a row for each of the values:

alt text

I have never seen more than 100% displayed in the % column of this pop out menu.

Has anyone come across this before? I'm worried we've misconfigured something somewhere which might be causing this.

Thanks

Tags (1)
1 Solution

jeffland
SplunkTrust
SplunkTrust

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

My guess is that this is a multivalue field. Most of your results probably either have two fields named "result" (it appears to be json in the background) or use both indexed and search time extraction on the result field (happens easily with json too if you're not paying attention). You can check this if you table your results like

| table _time results

and look at that table for rows containing SUCCESS or FAILURE in that column twice.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...