Splunk Core Certified User — Question 85
Which of the following is a Splunk internal field?
Answer options
- A. _raw
- B. host
- C. _host
- D. index
Correct answer: A
Explanation
The correct answer is _raw, as it is a fundamental internal field in Splunk that contains the raw data of the events. The other options, while relevant in a Splunk context, do not represent Splunk's internal fields; 'host' and 'index' are standard metadata fields, while '_host' is not a valid internal field.