Interesting fields are key-value pairs that Splunk extracts when searching the data. When you dispatch a search, Splunk will try to identify delimiters such as an equal sign or colon and assign the value on the left as the field and the value on the right as the value. It will then take these key-value pairs and list them under
interesting fields if that fields is atleast 20% of the search range by default. You can pop open the fields at the bottom of the selection and select any fields that you want at the top and they become
In addition, @DalJeanis commented at Why sometimes sourcetype doesn't appear under Selected Fields?
-- An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)
@vipmakka, go through Splunk Fundamentals 1 free course where module 3 talks about this in details.
Once you complete the self paced e-learning course you are eligible to take an exam and become Splunk Certified User as well 🙂