Feedback:

fields

Use the fields operator to either specify the fields to be returned or rename the fields. You can optionally add a plus (+) or minus (-) sign to respectively include or exclude a comma-separated list of additional fields in the result table.

Syntax

|fields <field> [as new_field] [, <field> [as new_field], ...]

|fields + <field> [as new_field] [, <field> [as new_field], ...]

|fields - <field> [as new_field] [, <field> [as new_field], ...]

|select <field> [as new_field] [, <field> [as new_field], ...]

Usage

Use the fields operator to filter the results set. If you plan to create visualizations, include fields necessary to show what you want to visualize.

Note: The select operator is an alias of fields. In other words, the usage for select is exactly the same as the usage for fields.

Optionally use the plus (+) or minus (-) sign to include additional fields in your results set. If these signs are not used, only the fields mentioned after the fields operator are displayed as the results set.

Note: If you use the plus (+) or minus (-) sign after the fields operator, you must include at least one field. Not doing so will throw an error.

Examples

Example 1: Select specific fields from results.

Copy 
|fields event_time, src, image, command_line

Example 2: Include multiple fields in output.

Copy 
|where dcid = "10" | fields dcid as UlinkID, sourcetype, bytes_in, bytes_out

Example 3: Exclude unwanted fields from output.

Copy 
|where dcid = "10" | select dcid as UlinkID, sourcetype, bytes_in, bytes_out

Example 4: Reorder and select event columns.

Copy 
|bin event_time span = 1h | where sourcetype contains_ci * and isnotnull(bytes_in) | fields + bytes_in as BytesIn, event_size as Size, category as Catg

Example 5: Select and display renamed fields.

Copy 
|where sourcetype contains_ci * | fields + bytes_in, event_size, category

Example 6: Filter to selected fields only.

Copy 
|where sourcetype != 'null' | fields + bytes_in, event_size, category | fields - action, dcid, dest

Example 7: Filters out events with no product name, then returns only the timestamp, activity type, and source hostname fields.

Copy 
ocsf | where metadata.product.name!='' | fields event_time, activity_name, src_endpoint.hostname