A default field that contains general information about the events that Splunk Enterprise has indexed. Internal fields are indicated by a leading underscore in their field name. For example:
_raw is an internal field that contains the original raw data of the event, while the value of
_time is the event's timestamp expressed in Unix time.
For more information
In the Knowledge Manager Manual:
In Getting Data In: