VMware ESXi and vSphere Cluster Management

Understanding and Using Fields in Splunk Searches

Learn how Splunk extracts fields from event data, how selected and interesting fields appear in the Search app, and how to filter results with field-value searches.

Splunk searches become much more useful when you can work with fields. A field is a named attribute associated with an event. Fields convert raw event text and event metadata into searchable attributes, allowing you to find, group, and investigate specific kinds of events.

What Are Fields in Splunk?

An event is an individual piece of event data, such as a log entry or machine-generated message. The original event may contain unstructured text, metadata, or structured content. Splunk can identify meaningful parts of that event and assign them names.

For example, an event might contain text like:

status=500 user=alex service=checkout

Splunk may recognize field-value pairs such as:

• status=500
• user=alex
• service=checkout

A field-value pair consists of a field name and its associated value. The field name describes what the data represents, and the value is the specific data found in an event. You can use these pairs to filter search results, compare events, and investigate activity.

Instead of searching only for a word such as checkout, you can search for a particular attribute, such as service=checkout. This makes the search more precise.

How Splunk Extracts Fields

Field extraction is the process of identifying field names and values from event metadata or event content. Splunk can extract some fields automatically while processing search results.

Metadata fields

Some fields are supplied as event metadata. They describe where the event came from or how Splunk classifies it. Common metadata fields include host, source, and sourcetype.

Fields recognized in event content

Splunk can also recognize fields from patterns in the event's content. Repeated structured patterns, especially key=value text, can provide usable fields. For example, an event containing user=alex may expose a field named user with the value alex.

Field availability depends partly on the events returned by the current search. A field may appear for one search but not another because the second search returned different event types, different data, or no events containing that field.

Where Fields Appear in the Search App

After you run a search that returns events, look for the fields sidebar or fields panel beside the search results. The panel presents fields that Splunk discovered or made available for the current result set.

1. Run a search that returns events.
2. Locate the fields panel associated with the results page.
3. Review the Selected Fields area.
4. Review the Interesting Fields area.
5. Expand a field to see values found in matching events.

When you expand a field, Splunk displays values observed in the current results. These values help you understand the data and can provide a convenient way to refine the search.

Selected Fields

Selected fields are fields shown by default because they are broadly useful for the active search. They commonly describe event metadata and help you identify the origin and classification of returned events.

The core examples are host, source, and sourcetype.

For example, if the selected fields show host=web01, the event came from the system identified as web01. If they show a file path as the source, that path identifies the input origin. The sourcetype indicates how Splunk classifies the incoming data format.

Interesting Fields

Interesting fields are fields Splunk identifies as potentially useful from the current returned data. They often come from recurring structured patterns in event text, such as key=value content.

For example, if many returned events contain user=alex, user=jamie, and similar entries, Splunk may show user as an interesting field. Expanding that field lets you inspect the values found in the matching events.

Interesting fields are context-sensitive. Their availability and displayed values can change when you change the search, time range, event types, or result set. A field that is interesting for one search may not appear for another.

Filtering Searches with Fields

Selecting a field value in the fields panel adds a field-based condition to the active search. For example, you can expand the host field and select web01.

1. Start with a broad search that returns events.
2. Open the host field in the fields panel.
3. Review the hostname values found in the results.
4. Select web01.
5. Review the updated search and its reduced result set.

The original search defines the initial set of matching events. The added host condition further restricts that set. The resulting events must satisfy the original search and be associated with the selected host.

The same restriction can be entered manually with field-value search syntax:

host=web01

This search returns events associated with the specified host. To combine a normal search term with the host condition, use:

error host=web01

This returns events that match the text term error and have the extracted field value host=web01.

General field-value syntax

The basic pattern is:

field_name=field_value

Replace field_name with an extracted field and field_value with the value you want to match. For example, a structured event might support conditions such as status=500 or user=alex.

Field-Based Search Behavior

A field constraint returns only events whose extracted field matches the specified value. If an event contains a similar value only in raw text but does not have the expected extracted field, it may not match the field-based condition.

Field filters can be combined with ordinary search terms and with other criteria. In a search such as error host=web01, both conditions narrow the results. This is a practical use of Boolean search concepts: multiple terms placed together generally require matching events to satisfy the combined criteria.

Adding more criteria usually makes a search more restrictive. For example, adding a sourcetype condition limits the search to events that match both the host and the specified data classification.

Practical Example: Inspect Default Event Metadata

1. Run a simple search that returns events.
2. Locate the selected fields area.
3. Identify host, source, and sourcetype.
4. Interpret the values as the event's origin system, input origin, and data classification.

These fields provide context before you investigate the event content. For example, a host value can tell you which machine generated the event, while the source and sourcetype can help distinguish input locations and data formats.

Practical Example: Discover Fields in Structured Event Text

1. Search for events containing repeated key=value-style content.
2. Review the interesting fields list.
3. Expand one field, such as user or status.
4. Inspect the values discovered in the result set.
5. Relate those values back to the matching events.

If the events contain status=500, expanding the status field may show 500 among the discovered values. Selecting that value can add a condition that returns only events with the extracted status value.

Troubleshooting Field Searches

An expected field does not appear

• The current search may have returned no events containing that field.
• The event format may not expose a recognizable field pattern.
• The field may not be automatically extracted for that data.

Verify that the search returns the expected events and inspect their raw structure. If the data contains information that is not extracted, an extraction appropriate to that data format may be needed.

Selecting a field value returns fewer results than expected

• The selected value may be more restrictive than intended.
• Only events with that exact extracted value can match.
• The initial search may not have included all expected data.

Review the condition added to the search, compare it with the original search, and inspect the available field values before selecting a different value.

A visible raw value cannot be used as an expected field

• The text may not have been extracted as a field.
• The formatting may differ between events.
• The expected field name may not match the name Splunk extracted.

Inspect the event and the available fields. Then validate the event's structure and extraction behavior before relying on a field-based filter.

Key Points

• A field is a named attribute associated with an event.
• Field-value pairs turn event information into searchable conditions.
• Splunk can obtain fields from event metadata and recognizable patterns in event content.
• Selected fields commonly include host, source, and sourcetype.
• Interesting fields are discovered from potentially useful patterns in the current result set.
• Expanding a field and selecting a value adds a corresponding restriction to the search.
• The manual form of a field filter is field_name=field_value, such as host=web01.