Splunk Search

conditionally using random()

abby_xr
Splunk Employee
Splunk Employee

Based on my dataset, I have 10 items in total and I wanna generate a new field randomly for each different item. 

E.g.:

basesearch

| eval new_field=case(
FieldA=item_1,(random() % 4) + 1,
FieldA=item_2,(random() % 4) + 1,
FieldA=item_3, (random() % 4) + 1,
......
FieldA=item_10, (random() % 4) + 1)

but the results of new_field for each item are different. what I want is the newfield_1 is fixed, for example,

"newfield_1=(random() % 4) + 1, if fiedA==item_1: FieldA=newfield_1 (newfield_1 won't change again)"

How can I keep consistent for the different items? Thank you for the help.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...