default field

default field


An indexed field that Splunk Enterprise recognizes in your event data at search time.

Three important default fields are host, source, and source type, which describe where the event originated. Other default fields include date/time fields, which provide additional searchable granularity to event timestamps. Splunk Enterprise also adds default fields classified as internal fields.

For more information

In Getting Data In:

In Managing Indexers and Clusters of Indexers:

In the Knowledge Manager Manual: