Events, Fields and Sourcetypes

What is it?

Splunk stores machine data as events — one timestamped record per log line. Each event is broken into fields (key=value pairs like user=j.rai, src=10.20.4.15), lives in an index, and is tagged with a sourcetype that says what kind of log it is (e.g. WinEventLog, sysmon, dns).

Why it matters

You search on FIELDS, not on raw text. Knowing that an authentication log has a user field and a src field — and which sourcetype holds them — is what lets you write a precise search instead of guessing keywords.

Where you see it

In the events list, each event shows its raw text plus extracted fields you can click to filter. The fields sidebar lists every field present and how many distinct values it has.

What normal looks like

A well-parsed event has a clear timestamp, a sourcetype that matches its content, and the fields you expect for that log type (user/host/src for auth; parent/child/image for process events).

What suspicious looks like

At this level nothing is suspicious yet — this is the data model. Suspicion comes from what the field VALUES say once you search and aggregate them.

How analysts investigate

Before searching, ask: which sourcetype holds the answer, and which field carries the value I care about? Then search that field in that sourcetype, not free text across everything.

Common beginner mistakes

Searching raw keywords across all data instead of a field in the right sourcetype — slow and imprecise.
Assuming a field is named the same in every sourcetype; auth may use user while endpoint uses Account_Name.

One log line becomes one searchable event

  raw log line:
    2026-03-02T02:11:15Z host=SRV-FIN-02 user=a.hakim result=success src=203.0.113.44 evt=4624
  becomes an EVENT with FIELDS:
    _time = 2026-03-02 02:11:15   sourcetype = WinEventLog:Security   index = main
    host=SRV-FIN-02  user=a.hakim  result=success  src=203.0.113.44  evt=4624
  you search fields:  sourcetype=WinEventLog:Security user=a.hakim result=success

Splunk extracts fields from each log line; you filter on those fields, scoped by sourcetype and time.

Quick check

You want failed logons for one account. What should your search be scoped to first?

A quick self-check — it doesn't affect your XP or progress.