How does Splunk determine which fields to extract from data?

Question

Antonio Ferri · Accepted Answer

Splunk automatically discovers many fields based on sourcetype and key/value pairs found in the data.

Antonio Ferri · Answer

Splunk only extracts the most interesting data from the last 24 hours.

Antonio Ferri · Answer

Splunk only extracts fields users have manually specified in their data.

Antonio Ferri · Answer

Splunk automatically extracts any fields that generate interesting visualizations.

List of questions