internal field

internal field

noun

A default field that contains general information about the events that Splunk Enterprise has indexed. Internal fields are indicated by a leading underscore in their field name. For example: _raw is an internal field that contains the original raw data of the event, while the value of _time is the event's timestamp expressed in Unix time.

For more information

In the Knowledge Manager Manual:

• Use default fields

In Getting Data In:

• About default fields (host, source, sourcetype, and more)