For most data sources in our set-up, sourcetype appears under Selected Fields, but there are cases in which it appears under the Interesting Fields section. Why is that?
According to this one - https://answers.splunk.com/answers/185864/selected-fields-in-fields-side-bar.html, selected fields have app-level defaults but if you change the selection at any time, you user preferences are stored locally for you. That probably means at one time you accidentally removed it from your preferences for that type of event.
An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)
According to this one - https://answers.splunk.com/answers/185864/selected-fields-in-fields-side-bar.html, selected fields have app-level defaults but if you change the selection at any time, you user preferences are stored locally for you. That probably means at one time you accidentally removed it from your preferences for that type of event.
An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)
