Using fields to search
When we explored the GUI in Chapter 1, The Splunk Interface, you probably noticed fields everywhere. Fields appear in the field picker on the left and under every event. Where fields actually come from is transparent to the user, who simply searches for key=value. We will discuss adding new fields in Chapter 3, Tables, Charts, and Fields, and in Chapter 10, Configuring Splunk.
Using the field picker
The field picker gives us easy access to the fields currently defined for the results of our query. Clicking on any field presents us with details about that field in our current search results.
As we go through the following items in this widget, we see a wealth of information right away:
Appears in X% of results is a good indication of whether we are getting the results we think we're getting. If every event in your results should contain this field, and this is not 100 percent, either your search can be made more specific or a field definition needs to be modified.
Show...
