Splunk internal fields contains general information about events and starts from underscore i.e. _ .

The statement is factually correct. Splunk automatically adds several internal fields to events during the indexing process. These fields contain metadata, which is general information about the event itself, such as its timestamp, source, and raw text. The established naming convention for these internal fields is that they always begin with a leading underscore () to distinguish them from fields extracted from the event data. Key examples include time, raw, and indextime.

The alternative, "False," is incorrect because the statement accurately describes the two primary characteristics of Splunk internal fields as defined in official documentation: their function (to hold event metadata) and their naming syntax (a leading underscore).

1. Splunk Enterprise Documentation

Search Manual

"About default fields": This official manual explicitly states

"Internal fields

such as raw and time

begin with an underscore character. These fields are added to your events at index time." This directly confirms both parts of the question.

2. Splunk Enterprise Documentation

Getting Data In

"Default fields": This document details the fields that Splunk Enterprise adds to data by default. It lists numerous fields starting with an underscore

such as bkt

cd

sourcetype

time

and describes them as containing information about the event's origin and its processing within Splunk.