Splunk Search

Ingestion Method as Field?

morethanyell
Contributor

Hi. I've noticed there are some hidden fields in every event ingested into Splunk, like _indextime. Is there some sort of hidden field where it tells the method of ingestion, such as _indexingmethod = TCP | FileMonitor | HEC | etc

Thanks in advance.

0 Karma
1 Solution

jawaharas
Motivator

I don't think there are any. The list of default fields can be referred here-

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Aboutdefaultfields

View solution in original post

jawaharas
Motivator

I don't think there are any. The list of default fields can be referred here-

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Aboutdefaultfields

View solution in original post

morethanyell
Contributor

I hope they include it in future version.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!