Understanding fields and lookups

In this section, we will look at fields and lookups in detail. Let’s start with fields.

Fields

Fields in Splunk tell a story about data that can be used to search and derive the required outcomes, such as reports, alerts, and dashboards. Raw data in Splunk is indexed as individual events by its source type definition. Fields are names given to specific portions of data by data administrators by extracting them out of the raw data during the search-time and index-time processes. Splunk, by default, assigns predefined fields to a data source, such as host, source, sourcetype, splunkserver, _time, and so on.

For example, take call record logs, which contain phone numbers from exchanged calls at a particular point in time. Let’s name the fields in the log data time_of_call, caller, callee, and duration.

You could build a report such as the number of calls per day and longest duration, and alert on numbers that are calling out to...