default field

default field

noun

An indexed field that Splunk Enterprise recognizes in your event data at search time.

Three important default fields are host, source, and source type, which describe where the event originated. Other default fields include date/time fields, which provide additional searchable granularity to event timestamps. Splunk Enterprise also adds default fields classified as internal fields.

For more information

In Getting Data In:

• About default fields (host, source, sourcetype, and more)

In Managing Indexers and Clusters of Indexers:

• Index time versus search time

In the Knowledge Manager Manual:

• About fields
• Use default fields