An array containing the names of multiple fields from events. This allows functions to operate on several fields simultaneously, such as when grouping by multiple criteria, selecting specific fields for output, or performing operations across multiple columns of data.

Field names in the array can be quoted or unquoted strings. Quoting is required when field names contain special characters, spaces, or might be confused with reserved keywords. For example, [hostname, severity, "user.name"] specifies three fields where the third field name contains a dot character.

Arrays of fieldnames are commonly used in functions like groupBy() for multi-field grouping, table() for selecting columns to display, and drop() or rename() for batch field operations.

groupBy([hostname, severity], function=count())

table([timestamp, user, action, result])

drop([temp_field1, temp_field2, debug_info])

select([username, email, "login.time"])

Functions using this Type: bucket(), collect(), concat(), correlate(), crypto:md5(), crypto:sha1(), crypto:sha256(), default(), drop(), dropEvent(), eval(), fieldset(), format(), groupBy(), hash(), ioc:lookup(), join(), kvParse(), lowercase(), matchAsArray(), readFile(), rename(), select(), selectFromMax(), selectFromMin(), selectLast(), selfJoin(), selfJoinFilter(), series(), sort(), table(), top(), wildcard()