Which of the following is a Splunk internal field?

Question

Options

• A_raw
• Bhost
• C_host
• Dindex

• A
  75% (18)
• B
  13% (3)
• C
  8% (2)
• D
  4% (1)

Explanation

_raw is a Splunk internal field, identifiable by its leading underscore - this naming convention is how Splunk marks fields it generates automatically. _raw stores the original, unprocessed event text exactly as it was indexed.

Why the distractors are wrong:

• B. host - a default field Splunk extracts at index time, but it is a default field, not an internal one. No underscore prefix.
• C. _host - this field does not exist in Splunk; it's a plausible-looking distractor combining the underscore convention with "host."
• D. index - another default field that identifies which index an event belongs to, but again, no underscore prefix and not classified as internal.

Memory tip: Splunk internal fields always start with an underscore (_). The real ones you'll encounter are _raw, _time, _indextime, and _meta. If you see an underscore prefix on a field name in Splunk, think internal. No underscore = default or custom field.

No community discussion yet for this question.