Splunk Search

Other interesting fields

rroberts
Splunk Employee
Splunk Employee

How does Splunk determine which fields to add to "other interesting fields"?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

View solution in original post

sideview
SplunkTrust
SplunkTrust

The module is called SuggestedFieldViewer, and you can get a pretty quick high level understanding of how it works just by looking at where that module appears in the default search view (flashtimeline.xml)

<module name="SuggestedFieldViewer">
  <param name="minDistinctCount">1</param>
  <param name="minFrequency">0.5</param>
  <param name="maxFields">50</param>
  <param name="exclude">
    <list>^date_.*</list>
  </param>
  <param name="link">
    <param name="view">report_builder_format_report</param>
  </param>
</module>

and you can read the autogenerated docs for the module by going here:

http://<your splunk host and port>/en-US/modules#Splunk.Module.SuggestedFieldViewer

sideview
SplunkTrust
SplunkTrust

oh. hehe. I'm sorry i should have skimmed the docs first before sending. minFrequency means the frequency with which the field appears across the events. So at 0.2, it'll screen out any fields that are only in <20% of the events.

0 Karma

rroberts
Splunk Employee
Splunk Employee

So the minFrequency is based on what? The module doc displays only..
minFrequency
(no description available)

Default value: 0.2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...