noun
The output produced in the Search app after transforming commands run on events. Since the search commands have processed the events, they're no longer considered events anymore. For example, the following search produces results.
index="_internal"
| head 50
| stats count by sourcetype
The results of the search look like this:
sourcetype | count |
---|---|
mongod | 1 |
splunkd | 36 |
splunkd_access | 8 |
splunkd_ui_access | 5 |
The output in the table was computed from the original events; the source types in the output are derived from events, but they no longer map to a particular event.