By default, which of the following fields would be listed in the fields sidebar under interesting Fields?

In Splunk Web the Fields sidebar is divided into “Selected Fields” and “Interesting Fields.”

The default metadata fields host, source, and sourcetype are always placed in the Selected Fields section.

Any other field that occurs in ≥ 20 % of the returned events but is not already in Selected Fields is placed under Interesting Fields. Because index is not one of the default Selected Fields, it meets these criteria and therefore appears in the Interesting Fields list by default.

A. host – One of the three default Selected Fields; therefore never listed under Interesting Fields by default.

C. source – Same as host: automatically displayed in Selected Fields, not Interesting Fields.

D. sourcetype – Also a default Selected Field, so it is excluded from Interesting Fields.

1. Splunk Documentation

Search Manual

“About the Fields sidebar

” § ‘Selected and Interesting Fields’ (Splunk Enterprise 9.x) – explains default placement of host

source

sourcetype and criteria for Interesting Fields.

2. Splunk Documentation

Knowledge Manager Manual

“Default fields

” § 2 – lists host

source

sourcetype as default metadata fields automatically displayed.