4.3 The Fields Sidebar

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

4.3 The Fields Sidebar

Key Takeaways Explain This Topic AI

The Fields sidebar lists Selected Fields and Interesting Fields beside Events results in the Search app.

Default Selected Fields are host, source, and sourcetype; selected fields display under each event.

Interesting Fields are common in the current result set—commonly taught as appearing in at least about 20% of events.

Field details show top values with counts and percentages so you can assess distribution before refining.

Clicking field values can add or exclude filters in the search, enabling rapid interactive refinement.

Last updated: August 2026

4.3 The Fields Sidebar

Objective 3.3 of the Splunk Core Certified User blueprint focuses on the Fields sidebar —the interactive panel that turns extracted fields into clickable investigation tools. If Domain 3.0 is 20% of the exam, this UI skill is how Splunk expects Users to refine searches without memorizing every value in advance.

Where the Fields Sidebar Lives

After you run a search in the Search app and results return on the Events tab, the interface typically shows:

UI region Role
Search bar + time picker Define and rerun the query
Timeline Visual distribution of events over time
Fields sidebar (left) Selected Fields + Interesting Fields
Events viewer (right) Event list with _raw and selected field lines

You can hide the sidebar to enlarge the events area, but for exam prep keep it visible—most 3.3 questions assume you know what each section means and what happens when you click.

Selected Fields

Selected Fields are fields Splunk displays under each event in the Events list. By default, Splunk selects:

host
source
sourcetype

That default trio is high-yield exam knowledge. Selected fields are about presentation and quick visibility , not about which fields exist. Many more fields may be extracted; only selected ones are pinned under every event row.

Why selected fields matter

You can scan host/source/sourcetype without expanding every event.

Adding status or user as selected makes incident review faster.

Removing clutter fields keeps the Events list readable.

How to change selected fields

Common User workflows:

Click a field name in the sidebar.

In field details, toggle whether the field is selected.

Or use the sidebar controls / All Fields style editor to add or remove selected fields.

Once selected, the field’s value line appears beneath matching events (when the field exists on that event).

Interesting Fields

Interesting Fields are fields that appear frequently enough in the current search result set to be listed automatically in the sidebar. Splunk’s common training rule is the 20% threshold :

If a field appears in at least about 20% of the returned events, it shows under Interesting Fields.

Implications:

Interesting Fields are result-set dependent . Change the search, and the interesting list can change.

A rare field (present in 2% of events) may be absent from Interesting Fields even though it exists when you expand an event.

Fields can move between “interesting” visibility and obscurity as you refine filters.

Category What it means Typical examples
Selected Fields Pinned for display under events host , source , sourcetype (defaults); plus any you add
Interesting Fields Common in current results (≥ ~20%) status , clientip , user , action , bytes

Other extracted fields Present on some events but not listed as interesting Low-frequency fields visible in event details / All Fields

Counts and Percentages

Click a field in the sidebar to open field details . This panel is a major User exam topic because it summarizes the field without writing stats yet.

Typical information shown:

Element Meaning
Count of values / events How often the field appears or how values distribute
Percentage Share of events or value frequency within the result set
Top values list Most common values for that field in these results
Reports / coverage indicators How widely the field is populated among returned events

Use this panel to answer questions like:

Which status codes dominate this hour?

Is failed action rare or common in these results?

Do most events share one host , or are errors spread across many hosts?

You are reading descriptive statistics for the current job , not the entire index history beyond your search constraints.

Click to Filter: The Sidebar as a Search Builder

The Fields sidebar is not read-only documentation—it is an interactive filter tool.

Common click actions

From field details or value interactions, Users can typically:

Action Effect on the search
Add value to search Appends a field=value constraint (AND behavior with existing terms)
Exclude value from search Adds a negative constraint (such as NOT field=value / exclude pattern)
Select field for display Toggles Selected Fields without necessarily changing the search string
Open value reports Explore distribution before committing to a filter

This supports an investigative loop:

Run a broad-but-bounded search ( index=web sourcetype=access_combined + time range).

Open status in the sidebar.

See that 500 is 12% of events.

Click to add status=500 .

Open clientip , identify a noisy address, add or exclude it.

Continue refining until the event set is actionable.

On the exam, if a question asks the fastest way to filter to a field value you see in results, the answer is often use the Fields sidebar / field value click actions , not manually inventing SPL from scratch (though both skills matter).

Field Details vs Expanding an Event

Do not confuse these two views:

View Scope Best for

Field details from sidebar Aggregate view across the result set Top values, counts, percentages, click-to-filter

Expanded single event One event’s full field list Seeing rare fields, validating extractions, reading all pairs

Interesting Fields can hide rare keys. Expanding an event (or using All Fields) reveals fields that never crossed the interesting threshold.

Selected vs Interesting: Exam Contrast Table

Question the exam might ask Answer focus
Which fields appear under each event by default? Selected: host , source , sourcetype
Why did bytes show in the sidebar? It was interesting/common in these results

Why is session_id missing from Interesting Fields? Too rare in this result set (below threshold) even if present on some events

How do you keep user visible under every event? Add user to Selected Fields
How do you quickly search only action=failed ? Click the value in field details to add it to the search
Practical Walkthrough
Search: index=web sourcetype=access_combined

Time range: Last 60 minutes.

Possible sidebar state:

Selected Fields
host (4)
source (1)
sourcetype (1)
Interesting Fields
status (12)
clientip (86)
method (3)
bytes (lots of distinct values)
useragent (40)

Interpretation drills:

Only one sourcetype appears—good, your sourcetype filter is clean.

Four hosts appear—errors may be unevenly distributed; click host to see percentages.

Twelve status values suggest more than just 200/404; open status before charting.

If you select status , each event row shows its status inline—faster scanning during triage.

Now click status → add 500 → rerun. Interesting Fields recalculate for the filtered set. Maybe clientip collapses from 86 values to 6. That concentration is exactly what sidebar-driven refinement is designed to reveal.

What the Fields Sidebar Is Not

For User exam boundaries:

It is not where you design CIM data models.

It is not the Field Extractor advanced workflow test focus.

It is not a replacement for knowing field=value syntax—you still must read and write SPL.

It is the primary UI for discovering values, gauging frequency, selecting display fields, and click-filtering.

Checklist for Objective 3.3

Before you leave this section, you should be able to:

Locate Selected Fields and Interesting Fields in the Search UI.

Name the default selected fields.

Explain the ~20% interesting-field idea relative to the current results .

Read counts/percentages in field details.

Use click actions to add or exclude field values.

Know when to expand an event to see non-interesting fields.

Those six skills map directly to “use the fields sidebar” on the blueprint and connect Domains 2 and 3: search results become interactive as soon as fields appear.