Using fields to search

When we explored the GUI in Chapter 1, The Splunk Interface, you probably noticed fields everywhere. Fields appear in the field picker on the left and under every event. Where fields actually come from is transparent to the user, who simply searches for key=value. We will discuss adding new fields in Chapter 3, Tables, Charts, and Fields, and in Chapter 11, Configuring Splunk.

Using the field picker

The field picker gives us easy access to the fields (currently defined) for the results of our query. Splunk will extract some fields from event data without your help, such as host, source, and sourcetype values, timestamps, and others. Additional fields to be extracted can be defined by you. Clicking on any field presents us with the details about that field in our current search results:

As we go through the following items in this widget, we see a wealth of information right away:

• N Value, X% of events is a good indication of whether we are getting the results we think we're getting. If every event in your results should contain this field, and this is not 100 percent, either your search can be made more specific or a field definition needs to be modified. In addition, N Value indicates the number of unique values that this field contains.
• Selected—Yes or No indicates whether the field is selected (is part of the search query results) or not (simply listed as interesting additional fields found by Splunk within the data).
• Reports—Top Values, Top Values by time, Rare values, and Events with this field
  • Top values (overall) shows a table of the most common values for this field for the time frame searched.
  • Top values by time shows a graph of the most common values occurring in the time frame searched.
  • Rare values shows a table of the most unique values for this field for the time frame searched.
  • (Show only) Events with this field adds fieldname="*" to your existing search to make sure that you only get the events that have this field. If the events you are searching for always contain the name of the field, in this case network, your query will be more efficient if you also add the field name to the query. In this case, the query would look like this: sourcetype="impl_splunk_gen" network="*" network.
• Values shows a very useful snapshot of the top ten most common values, Count is the number found for each of these values and % is the percentage that the value is found in this field in the results of the search.