In Splunk, the is_exact field indicates whether the count of distinct values for a particular field is exact or estimated. A value of:
* 1 means the count is exact.
* 0 means the count is an approximation.
Therefore, when is_exact is 0, it signifies that the distinct count of values for that field is an estimate, not an exact count.
References:
fields - Splunk Documentation