Splunk Search

Ingestion Method as Field?

morethanyell
Builder

Hi. I've noticed there are some hidden fields in every event ingested into Splunk, like _indextime. Is there some sort of hidden field where it tells the method of ingestion, such as _indexingmethod = TCP | FileMonitor | HEC | etc

Thanks in advance.

0 Karma
1 Solution

jawaharas
Motivator

I don't think there are any. The list of default fields can be referred here-

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Aboutdefaultfields

View solution in original post

jawaharas
Motivator

I don't think there are any. The list of default fields can be referred here-

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Aboutdefaultfields

morethanyell
Builder

I hope they include it in future version.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...