Fields

Fields contain data that Splunk extracts from events at index time. Splunk extracts basic time stamp information, host and source data, punctuation patterns, and event type data automatically. Use fields as arguments in the search command to refine or narrow your search results, or run reports on search results based on the data in fields.

Note: You can extract fields at index time and search time in addition to the fields that Splunk extracts by default at index time. Learn about extracting additional fields.

This table shows the some of the fields that Splunk indexes for events at index time:

Description	Fields
These are internal fields that contain general information (raw data, timestamp information, and index locations) about events in Splunk.	_index, _raw, _time
These are fields that contain information about where an event is from, what type it is, and how many lines it contains. These fields are indexed and added to the Fields menu by default.	eventtype, host, linecount, punct, source, sourcetype
These are fields that provide additional searchable granularity to event timestamps.	date_hour, date_mday, date_minute, date_month, date_second, date_wday, date_year, date_zone, timestamp

Use fields in Splunk Web

Choose fields for searching and reporting by using the "Fields picker" (drop-down above your search results). Fields that you choose are added to the Fields menu above your search results. Choose fields from the Fields menu to filter your searches, or create reports.

Note: The Fields picker contains field names that look like random words or groupings of characters. These are fields that Splunk attempts to extract based on commonly occurring patterns in the raw event data. You can select and rename these fields if you want.

Note: Internal fields are not available in the Fields picker menu. The information in internal fields is generally not useful. However, you can still use internal fields in your searches if you specify them as arguments directly in the search bar.

Field syntax

Field values are strings of information extracted from raw event data (and stored as strings). A field/value pair can be expressed in two ways:

field="value"
field=value

Wildcards

Use wildcards (*) to match multiple values of a field to a partial expression.
These are all valid wildcard expressions:

field=*foo
field= fo*o
field=foo*
field=*fo*o*

Note: You can't use wildcards with the eventtype field, or with an aliased sourcetype field.

Comparison operators

Use comparison operators (=, !=, <, >, <=, >=) to exactly match a value, or a range of field values in any search command.

Note: You can only use <, >, <=, and >= with numerical field values.

Note: You can only use = and != with multi-valued fields.

Operator	Example	Effect
=	field=foo	Field values that exactly match "foo".
!=	field!=foo	Field values that don't exactly match "foo".
<	field<x	Numerical field values that are less than x.
>	field>x	Numerical field values that are greater than x.
<=	field<=x	Numerical field values that are less than and equal to x.
>=	field>=x	Numerical field values that are greater than and equal to x.

Field naming

Field names can't contain non-alphanumeric characters. If a field name contains special characters, Splunk replaces those characters with an underscore (_). If a field name begins with an underscore or special characters, Splunk removes those from the beginning of the field name.

For example:

Original field name What Splunk turns it into

12345my/wierd]field my_wierd_field

$my-field my_field

Multi-value fields

Multi-value fields allow Splunk to recognize multiple values in a single field value string. You can tell Splunk to parse multiple values from a field using regular expression delimiters you define in fields.conf (Learn how to configure multi-value fields).

Use multi-value fields if you have an extracted field with more than one useful value in its value string. For example, use multi-value fields to parse multiple email addresses from a field to obtain the distinct count of the number of people an email was sent to:

If you have 3 events with the following 3 strings as values of the field To, multi-value fields allow you to count each name in the To field as individual values.

event #1, 'To' = Ben, Jack, James, Joe

event #2, 'To' = Kate, George,

event #3, 'To' = David

If you have multi-value fields configured correctly, Splunk recognizes 7 values of To (each name). If no multi-value fields are configured, Splunk only sees 3 values for To.

From this point, use any search command that supports multi-value fields to process the recognized field values.