Splunk Search

Other interesting fields

rroberts
Splunk Employee
Splunk Employee

How does Splunk determine which fields to add to "other interesting fields"?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

View solution in original post

sideview
SplunkTrust
SplunkTrust

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

sideview
SplunkTrust
SplunkTrust

oh. hehe. I'm sorry i should have skimmed the docs first before sending. minFrequency means the frequency with which the field appears across the events. So at 0.2, it'll screen out any fields that are only in <20% of the events.

0 Karma

rroberts
Splunk Employee
Splunk Employee

So the minFrequency is based on what? The module doc displays only..
minFrequency
(no description available)

Default value: 0.2

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...