About fields

Fields are searchable name-value pairs in event data, such as user_name=fred or ip_address=192.168.1.1. Fields are the building blocks of Splunk searches. When you search, you're matching search terms against segments of your data. You can search more precisely by using fields.

Consider the following SPL2 search:

search status=404

This search finds events with status fields that have a value of 404. When you run this search, the Splunk Cloud Platform does not look for events with any other status value. It also does not look for events containing other fields that share 404 as a value.