An indexed field that Splunk Enterprise recognizes in your event data at search time.
Three important default fields are host, source, and source type, which describe where the event originated. Other default fields include date/time fields, which provide additional searchable granularity to event timestamps. Splunk Enterprise also adds default fields classified as internal fields.
In Getting Data In:
In Managing Indexers and Clusters of Indexers:
In the Knowledge Manager Manual: