Splunk Search

What is an interesting field?

vipmakka
Engager
sourcetype=access_combined | fields clientip host action status

All Fields
Selected Fields
aaction 5
ahost 3
Interesting Fields
aclientip 100+

status 9

Tags (2)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Interesting fields are key-value pairs that Splunk extracts when searching the data. When you dispatch a search, Splunk will try to identify delimiters such as an equal sign or colon and assign the value on the left as the field and the value on the right as the value. It will then take these key-value pairs and list them under interesting fields if that fields is atleast 20% of the search range by default. You can pop open the fields at the bottom of the selection and select any fields that you want at the top and they become selected fields

http://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Knowledge/Aboutfields

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Interesting fields are key-value pairs that Splunk extracts when searching the data. When you dispatch a search, Splunk will try to identify delimiters such as an equal sign or colon and assign the value on the left as the field and the value on the right as the value. It will then take these key-value pairs and list them under interesting fields if that fields is atleast 20% of the search range by default. You can pop open the fields at the bottom of the selection and select any fields that you want at the top and they become selected fields

http://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Knowledge/Aboutfields

goelt2000
Explorer

where are these extractions defined? I do not see anything under props.conf on search head which comes with default Splunk.

 

EXTRACT-<class> = [<regex>|<regex> in <src_field>]

For example: if I search for 

index=_internal sourcetype=splunkd, I see a range of fields in "interesting fields".

Where in props.conf is the corresponding EXTRACT-<class> defined for it? 

I assume: Selected fields= index time fields.

Interesting fields=search time extracted fields

0 Karma

ddrillic
Ultra Champion

In addition, @DalJeanis commented at Why sometimes sourcetype doesn't appear under Selected Fields?

-- An interesting field is any field that appears in 20% or more of the data, but is not a selected field. (You can change the 20% number if you want.)

DUThibault
Contributor

@ddrillic "You can change the 20% number if you want." Where? Which .conf file or Splunk Web page?

0 Karma

bishtk
Communicator

Hi @DUThibault , did you get any scope on where we can change this Interesting field filtering percentage?

0 Karma

niketn
Legend

@vipmakka, go through Splunk Fundamentals 1 free course where module 3 talks about this in details.

Once you complete the self paced e-learning course you are eligible to take an exam and become Splunk Certified User as well 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vipmakka
Engager

Thank you skoelpin!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...