Using the field picker

The field picker gives us easy access to the fields (currently defined) for the results of our query. Splunk will extract some fields from event data without your help such as: host, source, and sourcetype values, timestamps, and others. Additional fields to be extracted can be defined by you. Clicking on any field presents us with the details about that field in our current search results:

As we go through the following items in this widget, we see a wealth of information right away:

• N Value, X% of events is a good indication of whether we are getting the results we think we're getting. If every event in your results should contain this field, and this is not 100%, either your search can be made more specific or a field definition needs to be modified. In addition, N Value indicates the number of unique values that this field contains.
• Selected-Yes or No indicates whether the field is selected (is part of the search query results) or not (simply listed as interesting additional fields found by Splunk within the data).
• Reports-Top Values, Top Values by time, Rare values, and Events with this field:
  • Top values (overall) shows a table of the most common values for this field for the time frame searched.
  • Top values by time shows a graph of the most common values occurring in the time frame searched.
  • Rare values show a table of the most unique values for this field for the time frame searched.
  • Events with this field adds fieldname="*" to your existing search to make sure you only get the events that have this field. If the events you are searching for always contain the name of the field (in this case, network), your query will be more efficient provided you also add the field name to the query. In this case, the query would look like this: sourcetype="impl_splunk_gen" network="*" network.
• Values shows a very useful snapshot of the top ten most common values, Count is the number found for each of these values, and % is the percentage that the value is found in this field in the results of the search.