sourcetype-fields

The fake_tshrt Splunk index contains network, cloud, collaboration, email, Windows, and Linux sourcetypes. Available fields include data types, distinct values, and common values to facilitate data analysis and SPL query writing.

To find field names and types for a specific Splunk sourcetype, request a detailed field breakdown for that sourcetype. The reference provides field names, data types, distinct values, and common values for sources like FAKE:azure:aad:signin.

Dotted field names in Splunk SPL queries require specific quoting syntax to parse correctly. The field reference includes guidance on properly quoting dotted field names to ensure accurate data extraction and query execution.

Yes, this data dictionary supports Splunk dashboard development for network security events. You can look up available fields for sourcetypes like FAKE:cisco:asa to identify source IP, destination port, and action taken for investigations.

Yes, the fake_tshrt index includes cloud and collaboration data sources. The field reference covers multiple categories including cloud, collaboration, email, Windows, and Linux data sourced from The Fake T-Shirt Company synthetic data.

The best way to write accurate SPL queries using synthetic Splunk data is to consult a comprehensive field reference. This ensures you use correct field names, understand data types, and apply proper quoting for dotted fields.