Regarding Splunk's eval random() function

[maverick]

Since it does not appear that you can pass a number into the random() function, I'm curious to know what is being used to seed it's "randomness".

Is it the first or last timestamp of the event(s) in your result set, or maybe the total number of events returned in the result set? Something else?

[Marklar]

The seed is generated from the pid and the time of day, not anything to do with the results.

[Marklar]

Correct. Every search is started in a new process, which is when the random number generator is seeded.

[maverick]

Okay. and by time of day you mean the current time that the search is actually ran?