Using default fields
Using one or more default fields in your searches will improve the performance of your searches.
Fields are extracted from event data at either index time or search time. The fields that are extracted automatically at index time are known as default fields.
Default fields serve a number of purposes. For example, the default field index identifies the index in which the event is located. The default field timestamp specifies the time at which the event occurred. Splunk software uses the values in some of the fields, particularly sourcetype, when indexing the data, in order to create events properly. After the data has been indexed, you can use the default fields in your searches.
Using one or more default fields in your searches will improve the performance of your searches.
The following table describes some of the default fields you can use in your searches:
| Field name | Description |
|---|---|
| host | The host of an event is the host name, IP address, or fully qualified domain name of the network machine from which the event originated. In a distributed environment, you can use the host field to search data from specific machines. |
| index | An index is a repository for data. When the Splunk platform indexes raw data, it transforms the data into searchable events. There are two types of indexes:
|
| source | The source of an event is the file or directory path, network port, or script from which the event originated. |
| sourcetype | The sourcetype of an event tells you what kind of data it is, usually based on how the data is formatted. This classification lets you search for the same type of data across multiple sources and hosts. |
| timestamp | The timestamp records the time at which the event occurred. If an event doesn't have a timestamp, the time in which the event is indexed is added as the timestamp. The internal field _time stores the timestamp. You can use the time range picker to narrow the time window for your search. Using a specific time range is one of the most efficient ways to optimize your searches. |
| _event | The internal field _event can be used to test the shape of the whole event. For example, you can determine if the events have a specific field with a specific data type:
JSON
|