SPLK-1001 · Question #194
By default, which of the following fields would be listed in the fields sidebar under interesting Fields?
The correct answer is D. sourcetype. The fields sidebar in Splunk shows the default fields and the interesting fields for the events that match your search. The default fields are host, source, and sourcetype, which are extracted for every event at index time. The interesting fields are fields that appear in at…
Question
By default, which of the following fields would be listed in the fields sidebar under interesting Fields?
Options
- Ahost
- Bindex
- Csource
- Dsourcetype
How the community answered
(42 responses)- A7% (3)
- B2% (1)
- C14% (6)
- D76% (32)
Explanation
The fields sidebar in Splunk shows the default fields and the interesting fields for the events that match your search. The default fields are host, source, and sourcetype, which are extracted for every event at index time. The interesting fields are fields that appear in at least 20% of the events in your search results. You can also select additional fields to display in the fields sidebar1. By default, the index field is not listed in the fields sidebar, because it is not a default field nor an interesting field. The index field is a metadata field that indicates which index the event belongs to. Metadata fields are not extracted from the event data, but are added by the indexer as part of the indexing process. Metadata fields are not shown in the fields sidebar, but you can use them in your search queries. Therefore, among the four options, only sourcetype would be listed in the fields sidebar under interesting fields by default.
Topics
Community Discussion
No community discussion yet for this question.