Simple explanation
Fields are the searchable name-value pairs that give structure to otherwise raw event text. Some fields exist automatically on every event; others get extracted based on the data's actual content.
Technical explanation
- Default/internal fields — automatically present on every indexed event:
_time(timestamp),_raw(the original raw event text),host,source(the file/path/data origin),sourcetype(the format/type classification of the data),index(which index the event lives in). Internal fields conventionally start with an underscore. - Automatic field extraction — Splunk automatically discovers many fields at search time based on recognizable patterns, especially key=value pairs already present in the raw data, and based on the event's sourcetype.
- Field extraction at index time vs. search time — some extraction happens as data is indexed (less flexible, but faster at search time); most field extraction in modern Splunk usage happens dynamically at search time, which is more flexible since it doesn't require re-indexing to add new field extractions later.
- Custom field extraction — when automatic extraction doesn't correctly parse a field, users can define their own extraction rules (via regex or the interactive Field Extractor tool).
- Case sensitivity — field NAMES are case-sensitive; field VALUES are not.
Synonyms / related terms
| Term | Means | |---|---| | IFX | Interactive Field Extractor, the GUI tool for building custom extractions | | _raw | The internal field holding original, unparsed event text | | Default field | host, source, sourcetype, index, _time — present on every event |
Concept Check
"A search for Status=200 returns zero results, even though the raw events clearly contain status=200 (lowercase)." This is expected — field names are case-sensitive, so Status and status are treated as entirely different fields; the search needs to match the field name's actual case exactly, even though the VALUE 200 itself wouldn't have been case-sensitive if it had been text.
Interview-style Q&A
Q: Why is search-time field extraction generally preferred over index-time extraction? A: "Flexibility, mainly. If you extract fields at index time and later realize you need a different field or a fix to the extraction logic, you'd have to re-index the data to apply it retroactively — often impractical at scale. Search-time extraction can be added or changed at any point and applies to all existing data immediately, without touching what's already stored."
Memory trick
"Underscore means Internal" — a fast visual cue: any field starting with _ (like _time, _raw) is a Splunk-internal default field, not something extracted from the data's actual content.