Quantcast
Viewing all articles
Browse latest Browse all 13053

Splunk Default Fields in Data

What happens during indexing if my data were to have key value pairs where the key is the same as one of the default Splunk fields? For instance, say my data looked like this...

_time="2014-01-09 12:15:15" host="myhost" source="mysource" sourcetype="mysourcetype" etc...

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>