Implementing Splunk 7, Third Edition - Third Edition

Using the field picker

The field picker gives us easy access to the fields (currently defined) for the results of our query. Splunk will extract some fields from event data without your help such as: host, source, and sourcetype values, timestamps, and others. Additional fields to be extracted can be defined by you. Clicking on any field presents us with the details about that field in our current search results:

As we go through the following items in this widget, we see a wealth of information right away:

• N Value, X% of events is a good indication of whether we are getting the results we think we're getting. If every event in your results ...