# Fields tab

![Fields tabs in Splunk Input](/files/6grxYYSmfVHGCGzAb819)

In this tab, you can define the following properties and fields, as described in the table below.

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Option</td><td>Description</td></tr><tr><td><strong>Splunk query expression</strong></td><td><p>This field defines the Splunk query. Note that unlike the queries defined in the Splunk user interface, you must start the query with the term: <code>search</code></p><p>For example:</p><pre><code>search * | head 100
</code></pre><p>One capability of Splunk search is field selection. This allows you to get access to Splunk-parsed fields within the _raw column. To select specific fields, use this syntax at the end of your defined search query:</p><p><code>... | field index source OpCode</code></p></td></tr><tr><td><strong>Execute for each row</strong></td><td><p>If checked, a new query is issued for each row of data coming into the step. You can reference incoming fields of data using the <code>?{&#x3C;Field>}</code> syntax. For example, if you want to use the incoming field Size to drive the limit of results coming in, type this:</p><p><code>search *head ?{Size}</code></p></td></tr><tr><td><strong>Name</strong></td><td>Name of the field.</td></tr><tr><td><strong>Splunk name</strong></td><td>Indicates the Splunk name for the field.</td></tr><tr><td><strong>Type</strong></td><td>Specifies the data type of the field.</td></tr><tr><td><strong>Length</strong></td><td>Indicates the length of the field.</td></tr><tr><td><strong>Format</strong></td><td>Specifies the format of the field.</td></tr><tr><td><strong>Get fields</strong></td><td>Displays the field metadata and displays it in the <strong>Fields</strong> tab. After you have detected the field metadata using the <strong>Get Fields</strong> button on the <strong>Fields</strong> tab, you may choose to delete metadata fields that are not relevant to your specific query. Since each field must be translated to its mapped data type, removing unused fields should increase performance.</td></tr><tr><td><strong>Preview</strong></td><td>Provides a first look at the data. Clicking <strong>Preview</strong> causes the Enter preview size window to appear. Enter the maximum number of records that you want to preview, then click <strong>OK</strong>. The preview data appears in the Examine preview data window.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.pentaho.com/pdia-data-integration/10.2-data-integration/pdi-transformation-steps-reference-overview/splunk-input/options-splunk-input/fields-tab.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.