Simple explanation
The fields sidebar is where you actually interact with fields visually — this lesson covers its structure and the meaningful distinction between its two main field lists.
Technical explanation
- Selected Fields — a curated list of fields displayed directly under each event in the results; a small default set (like
host,source,sourcetype) is selected automatically, and users can add more. - Interesting Fields — fields Splunk determines are relevant based on appearing in at least 20% of the returned events; shown in the sidebar but not directly under each event unless promoted to Selected.
- All Fields — the complete list of every field present anywhere in the result set, including ones appearing rarely; accessible via the "All Fields" link, which also provides field descriptions where available.
- Field sidebar icons: a lowercase "a" indicates an alphanumeric (text) field; a "#" indicates a numeric field.
- The number next to a field name in the sidebar shows the count of UNIQUE values for that field within the current results — not the total occurrence count.
- Promoting a field — clicking a field in the sidebar and confirming adds it from Interesting Fields to Selected Fields, making it appear inline under every event going forward for that search.
Synonyms / related terms
| Term | Means | |---|---| | Interesting Field | A field present in at least 20% of results | | Selected Field | A field displayed inline under each event |
Concept Check
"A field shows the number '47' next to it in the sidebar. Does this mean the field appeared in 47 events?" Not necessarily — that number represents the count of unique values for the field, not the number of events containing it. A field could appear in thousands of events while only having 47 distinct values.
Interview-style Q&A
Q: Why does Splunk use a 20% threshold for Interesting Fields instead of just showing every field that appears at all? A: "In a large, varied result set, dozens or hundreds of fields might appear at least once, most of them irrelevant noise for the specific search at hand. The 20% threshold is a practical filter — a field showing up in a fifth or more of your results is far more likely to be genuinely relevant to understanding the pattern you're looking at than one that appears in a handful of outlier events."
Memory trick
"Selected shows Always, Interesting shows Often, All shows Everything" — three field-list tiers, each tied to how consistently a field needs to appear to make that list.