Other interesting fields

[rroberts]

How does Splunk determine which fields to add to "other interesting fields"?

[sideview · Accepted solution]

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

[sideview]

oh. hehe. I'm sorry i should have skimmed the docs first before sending. minFrequency means the frequency with which the field appears across the events. So at 0.2, it'll screen out any fields that are only in <20% of the events.

[rroberts]

So the minFrequency is based on what? The module doc displays only..
minFrequency
(no description available)

Default value: 0.2