Welcome to the first entry in a new series. Where our Splunk® Glossary posts introduce core vocabulary for newcomers, this series digs into the corners of the platform that most beginners walk right past. If you have your footing in Splunk and want to see what else it can do, this one is for you.
Today’s hidden feature: Splunk ships with a random number generator, and it opens up some genuinely unexpected possibilities.
The SPL eval function random() returns a pseudo-random integer between zero and just over two billion. On its own, that sounds like a utility for sampling data or generating test values, and it is. But pair it with the modulo operator and you can constrain that giant number to any range you want. random()%6 gives you a dice roll. random()%52 gives you a card draw. And because the makeresults command lets you generate events out of thin air, you do not need a single byte of indexed data to start playing with it.
That word “playing” is deliberate. Once you can generate random numbers on demand, you can build games entirely inside a Splunk search. A great example is a Valentine’s Day slot machine dashboard built by Ableversity’s founder, Michael Camp Bentley, a working Splunk consultant himself. He shared it publicly on Pastebin, and you can view the full source here.
How it works under the hood
The search uses makeresults to create an event, defines a set of Valentine themed reel symbols as a multivalue field, then uses random() with modulo to pick an index and mvindex to pull the matching symbol. Two appendcols subsearches repeat the trick, giving the dashboard three independent reels. A case() statement acts as the payout table, checking for three of a kind or matching pairs and multiplying the result by a bet amount the user selects from a dropdown. The dashboard refreshes every 30 seconds, so the reels spin themselves.
A toy with real skills inside
A toy? Absolutely. But look at the skills packed into it: multivalue field manipulation with makemv and mvexpand, subsearches, dashboard tokens, conditional logic with case(), and dashboard refresh behavior. Those are the same building blocks behind serious production dashboards. The slot machine just makes practicing them fun.
There is a real lesson here for anyone building Splunk skills. The platform rewards experimentation, and some of the strongest learning happens when you stop treating it purely as a work tool and start asking what else it can do. Rebuilding this dashboard piece by piece, or designing your own game from scratch, will teach you more about eval functions and dashboard XML than most tutorials will.
That spirit of experimentation is baked into how we teach. The person who built this slot machine is the same person who built our training platform, and the approach carries through: learn the fundamentals, then push on them until you find out what they can really do. Check out AbleU on web, iOS, or Android to see where you can start.
All trademarks, logos and brand names are the property of their respective owners. Use of these names does not imply endorsement.