Regarding Splunk's eval random() function - Splunk Community

Splunk Search

Since it does not appear that you can pass a number into the random() function, I'm curious to know what is being used to seed it's "randomness".

Is it the first or last timestamp of the event(s) in your result set, or maybe the total number of events returned in the result set? Something else?

The seed is generated from the pid and the time of day, not anything to do with the results.

Correct. Every search is started in a new process, which is when the random number generator is seeded.

Okay. and by time of day you mean the current time that the search is actually ran?

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...