Splunk Search

Regarding Splunk's eval random() function

maverick
Splunk Employee
Splunk Employee

Since it does not appear that you can pass a number into the random() function, I'm curious to know what is being used to seed it's "randomness".

Is it the first or last timestamp of the event(s) in your result set, or maybe the total number of events returned in the result set? Something else?

Marklar
Splunk Employee
Splunk Employee

The seed is generated from the pid and the time of day, not anything to do with the results.

Marklar
Splunk Employee
Splunk Employee

Correct. Every search is started in a new process, which is when the random number generator is seeded.

maverick
Splunk Employee
Splunk Employee

Okay. and by time of day you mean the current time that the search is actually ran?

Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...