4.3 The Fields Sidebar

4.3 The Fields Sidebar

Objective 3.3 of the Splunk Core Certified User blueprint focuses on the Fields sidebar—the interactive panel that turns extracted fields into clickable investigation tools. If Domain 3.0 is 20% of the exam, this UI skill is how Splunk expects Users to refine searches without memorizing every value in advance.

Where the Fields Sidebar Lives

After you run a search in the Search app and results return on the Events tab, the interface typically shows:

You can hide the sidebar to enlarge the events area, but for exam prep keep it visible—most 3.3 questions assume you know what each section means and what happens when you click.

Selected Fields

Selected Fields are fields Splunk displays under each event in the Events list. By default, Splunk selects:

• host
• source
• sourcetype

That default trio is high-yield exam knowledge. Selected fields are about presentation and quick visibility, not about which fields exist. Many more fields may be extracted; only selected ones are pinned under every event row.

Why selected fields matter

• You can scan host/source/sourcetype without expanding every event.
• Adding status or user as selected makes incident review faster.
• Removing clutter fields keeps the Events list readable.

How to change selected fields

Common User workflows:

1. Click a field name in the sidebar.
2. In field details, toggle whether the field is selected.
3. Or use the sidebar controls / All Fields style editor to add or remove selected fields.

Once selected, the field’s value line appears beneath matching events (when the field exists on that event).

Interesting Fields

Interesting Fields are fields that appear frequently enough in the current search result set to be listed automatically in the sidebar. Splunk’s common training rule is the 20% threshold:

If a field appears in at least about 20% of the returned events, it shows under Interesting Fields.

Implications:

• Interesting Fields are result-set dependent. Change the search, and the interesting list can change.
• A rare field (present in 2% of events) may be absent from Interesting Fields even though it exists when you expand an event.
• Fields can move between “interesting” visibility and obscurity as you refine filters.

Counts and Percentages

Click a field in the sidebar to open field details. This panel is a major User exam topic because it summarizes the field without writing stats yet.

Typical information shown:

Use this panel to answer questions like:

• Which status codes dominate this hour?
• Is failed action rare or common in these results?
• Do most events share one host, or are errors spread across many hosts?

You are reading descriptive statistics for the current job, not the entire index history beyond your search constraints.

Click to Filter: The Sidebar as a Search Builder

The Fields sidebar is not read-only documentation—it is an interactive filter tool.

Common click actions

From field details or value interactions, Users can typically:

This supports an investigative loop:

1. Run a broad-but-bounded search (index=web sourcetype=access_combined + time range).
2. Open status in the sidebar.
3. See that 500 is 12% of events.
4. Click to add status=500.
5. Open clientip, identify a noisy address, add or exclude it.
6. Continue refining until the event set is actionable.

On the exam, if a question asks the fastest way to filter to a field value you see in results, the answer is often use the Fields sidebar / field value click actions, not manually inventing SPL from scratch (though both skills matter).

Field Details vs Expanding an Event

Do not confuse these two views:

Interesting Fields can hide rare keys. Expanding an event (or using All Fields) reveals fields that never crossed the interesting threshold.

Selected vs Interesting: Exam Contrast Table

Practical Walkthrough

Search:

index=web sourcetype=access_combined

Time range: Last 60 minutes.

Possible sidebar state:

Selected Fields

• host (4)
• source (1)
• sourcetype (1)

Interesting Fields

• status (12)
• clientip (86)
• method (3)
• bytes (lots of distinct values)
• useragent (40)

Interpretation drills:

1. Only one sourcetype appears—good, your sourcetype filter is clean.
2. Four hosts appear—errors may be unevenly distributed; click host to see percentages.
3. Twelve status values suggest more than just 200/404; open status before charting.
4. If you select status, each event row shows its status inline—faster scanning during triage.

Now click status → add 500 → rerun. Interesting Fields recalculate for the filtered set. Maybe clientip collapses from 86 values to 6. That concentration is exactly what sidebar-driven refinement is designed to reveal.

What the Fields Sidebar Is Not

For User exam boundaries:

• It is not where you design CIM data models.
• It is not the Field Extractor advanced workflow test focus.
• It is not a replacement for knowing field=value syntax—you still must read and write SPL.
• It is the primary UI for discovering values, gauging frequency, selecting display fields, and click-filtering.

Checklist for Objective 3.3

Before you leave this section, you should be able to:

1. Locate Selected Fields and Interesting Fields in the Search UI.
2. Name the default selected fields.
3. Explain the ~20% interesting-field idea relative to the current results.
4. Read counts/percentages in field details.
5. Use click actions to add or exclude field values.
6. Know when to expand an event to see non-interesting fields.

Those six skills map directly to “use the fields sidebar” on the blueprint and connect Domains 2 and 3: search results become interactive as soon as fields appear.