There are internal fields that can tell you that:
< myevent > | eval cd=_cd | eval bkt= _bkt | table cd bkt index splunk_server _time source host sourcetype _raw
There are internal fields that can tell you that:
< myevent > | eval cd=_cd | eval bkt= _bkt | table cd bkt index splunk_server _time source host sourcetype _raw