What will always appear in the Selected Fields list?

Question

Options

• Aindex
• Baction
• Cclientip
• Dsourcetype

• A
  14% (5)
• B
  5% (2)
• C
  3% (1)
• D
  78% (29)

Explanation

sourcetype is one of three fields that Splunk always includes in the Selected Fields list by default - alongside host and source - regardless of what data is being searched. These three fields are hardcoded as default selected fields because they are fundamental to how Splunk categorizes and indexes all data.

index (A) is a metadata field that identifies which Splunk index the data resides in, but it does not automatically appear in the Selected Fields list. action (B) is an event-specific field (common in access logs) that only appears when present in your data, never by default. clientip (C) is similarly data-dependent - it only shows up in the fields sidebar when your search results actually contain that field.

Memory tip: Think of the three permanent Selected Fields as "How Splunk Sees" - Host, Source, Sourcetype. Of those three, sourcetype is the one that appears in exam distractors most often, making it a reliable anchor to memorize.

No community discussion yet for this question.