3.3 Contents of Search Results

3.3 Contents of Search Results

Quick Answer: Each matching event shows _raw (original text) and _time, plus defaults like host, source, sourcetype, and index. The fields sidebar separates Selected fields (displayed/pinned) from Interesting fields (commonly occurring extractions in this result set).

Topic 2.3 Identify the contents of search results asks you to read what Splunk returns—not yet to write advanced SPL. After you run a basic search (2.1) in a time window (2.2), you must recognize the anatomy of an event and the sidebar’s field groupings.

Anatomy of an event

An event is one searchable record. In the Events tab, you usually see a timestamp, the raw message, and field chips or an expanded field list.

Core fields you must know

These defaults are assigned for essentially all indexed events. _raw and _time are foundational; host, source, and sourcetype are the classic trio taught in Intro to Splunk; index tells you where the event lives.

_raw in practice

Example _raw (web access style):

192.0.2.10 - - [01/Aug/2026:10:15:22 +0000] "GET /login HTTP/1.1" 500 512

Your keyword search for 500 or "GET /login" matches against this text (and searchable fields). Expanding the event shows _raw in full plus extracted fields such as status, clientip, or method when the sourcetype extracts them.

_time versus what you see on screen

_time is stored as a precise timestamp (internally epoch-based) and displayed in the UI according to your timezone preferences. If _time is wrong because of upstream timestamp misconfiguration, the event can appear in the “wrong” day even though _raw looks right—User-level awareness helps you trust results carefully.

host, source, sourcetype: the discovery trio

Analysts often start broad, then constrain with these three:

index=web host=web01.example.com sourcetype=access_combined

Exam tip: source is not the same as sourcetype. Source is origin path/stream; sourcetype is format classification. Mixing them up is a common wrong answer pattern.

index field

index=security failed login

Without an explicit index=, Splunk searches default indexes configured for your role (often including main, depending on environment). Knowing the index field value on returned events confirms whether you are looking at security logs, application logs, or something unexpected.

Selected fields versus Interesting fields

After events return, the fields sidebar (left) organizes fields roughly as:

Selected fields

Selected fields are fields chosen to appear more prominently with events (as columns or highlighted field lists). Defaults such as host, source, and sourcetype are commonly selected out of the box. You can select additional fields so every event display includes them—useful when you always want status or user visible.

Interesting fields

Interesting fields are other fields present in the current result set that meet Splunk’s “interesting” threshold (commonly based on how frequently the field appears among returned events—often discussed as appearing in a meaningful percentage of events). They are candidates you may click to filter or to move into Selected.

Exact sidebar labeling can vary slightly by Splunk version, but the Selected vs Interesting distinction is core User vocabulary for topic 2.3 and connects to Domain 3 (Using Fields).

Reading an event in the UI (workflow)

1. Run a basic search; open Events.
2. Skim timestamps—do they match your intended window?
3. Read _raw—does the message match the incident narrative?
4. Check host / source / sourcetype / index—right system and data type?
5. Glance at Interesting fields—any field (status, user, action) that explains the story?
6. Only then refine (2.4) or transform (Domain 5).

Sample event field map

Here, defaults locate the event; extracted fields enrich it. Topic 2.3 emphasizes recognizing both layers exist—even when you have not yet mastered field search syntax (Domain 3).

What results are not (scope guardrails)

At Core User Basic Searching depth, do not treat these as required result-content topics:

• CIM data models and normalized data-model datasets
• Field aliases, calculated fields, or Field Extractor (FX) workflows (Power User)
• Tags and event types as primary classification tools (Power User)

You may see extra fields that knowledge objects added, but the exam focus for 2.3 is identifying _raw, _time, defaults, and Selected vs Interesting.

Common misconceptions

Practice drill

Search: index=_internal sourcetype=splunkd with Last 60 minutes (if permitted in your lab). Expand one event and list:

1. _time display value
2. host, source, sourcetype, index
3. Three Interesting fields and one Selected field

If you can complete that drill cold, you are aligned with topic 2.3.

Summary bridge to refining

Once you can name what is inside a result, refining searches (2.4) becomes intentional: add a keyword from _raw, or add host=web01, because you saw those values in the event contents—not because you guessed.