internal field

internal field


A default field that contains general information about the events that Splunk Enterprise has indexed. Internal fields are indicated by a leading underscore in their field name. For example: _raw is an internal field that contains the original raw data of the event, while the value of _time is the event's timestamp expressed in Unix time.

For more information

In the Knowledge Manager Manual:

In Getting Data In: