https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352664#M64627 <P>Perfect @DalJeanis - thank you.</P> Tue, 08 Aug 2017 02:25:30 GMT ddrillic 2017-08-08T02:25:30Z https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352662#M64625 <P>For most data sources in our set-up, sourcetype appears under Selected Fields, but there are cases in which it appears under the Interesting Fields section. Why is that?</P> Sun, 06 Aug 2017 01:06:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352662#M64625 ddrillic 2017-08-06T01:06:43Z https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352663#M64626 <P>According to this one - <A href="https://answers.splunk.com/answers/185864/selected-fields-in-fields-side-bar.html">https://answers.splunk.com/answers/185864/selected-fields-in-fields-side-bar.html</A>, selected fields have app-level defaults but if you change the selection at any time, you user preferences are stored locally for you. That probably means at one time you accidentally removed it from your preferences for that type of event.</P> <P>An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)</P> Sun, 06 Aug 2017 22:26:16 GMT https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352663#M64626 DalJeanis 2017-08-06T22:26:16Z https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352664#M64627 <P>Perfect @DalJeanis - thank you.</P> Tue, 08 Aug 2017 02:25:30 GMT https://community.splunk.com/t5/Getting-Data-In/Why-sometimes-sourcetype-doesn-t-appear-under-Selected-Fields/m-p/352664#M64627 ddrillic 2017-08-08T02:25:30Z