A fieldname identifies a specific field within an event. Field names can be unquoted if they contain only alphanumeric characters and underscores, but must be enclosed in double quotes if they contain special characters, spaces, dots, or might conflict with reserved keywords.

Field names are case-sensitive and can reference both standard fields created during data ingestion and derived fields created during query execution. Nested field names using dot notation, for example, user.name, should be quoted to avoid parsing ambiguity.

Common examples include simple names like hostname or severity, and quoted names like "@timestamp", "response.time", or "user name" when special characters or spaces are present.

hostname = "server"
severity = "High"
username = "asmith"
status_code = 404

"@timestamp" > 0
"user.name" = "alan.smith"
"response-time" <= 200
"user name" = "abrown"
"source.ip.address" = "192.168.0.1"

Functions using this Type: asn(), avg(), base64Decode(), base64Encode(), bitfield:extractFlags(), bitfield:extractFlagsAsArray(), bitfield:extractFlagsAsString(), callFunction(), cidr(), concat(), concatArray(), count(), counterAsRate(), crypto:md5(), crypto:sha1(), crypto:sha256(), dropEvent(), eval(), fieldset(), findTimestamp(), format(), formatDuration(), formatTime(), hash(), hashMatch(), in(), ipLocation(), json:prettyPrint(), kvParse(), length(), lower(), math:abs(), math:arccos(), math:arcsin(), math:arctan(), math:ceil(), math:cos(), math:cosh(), math:deg2rad(), math:exp(), math:expm1(), math:floor(), math:log(), math:log10(), math:log1p(), math:log2(), math:mod(), math:pow(), math:rad2deg(), math:sin(), math:sinh(), math:sqrt(), math:tan(), math:tanh(), max(), min(), parseCEF(), parseCsv(), parseFixedWidth(), parseHexString(), parseInt(), parseLEEF(), parseTimestamp(), parseUri(), parseUrl(), parseXml(), percentage(), percentile(), range(), rdns(), regex(), rename(), replace(), reverseDns(), round(), sample(), sankey(), selectFromMax(), selectFromMin(), shannonEntropy(), slidingTimeWindow(), split(), splitString(), start(), stdDev(), stripAnsiCodes(), subnet(), sum(), text:editDistance(), text:trim(), text:length(), text:positionOf(), text:substring(), time:dayOfMonth(), time:dayOfWeek(), time:dayOfWeekName(), time:dayOfYear(), time:hour(), time:millisecond(), time:minute(), time:month(), time:monthName(), time:second(), time:weekOfYear(), time:year(), timeChart(), tokenHash(), top(), transpose(), unit:convert(), upper(), urlDecode(), urlEncode(), worldMap(), writeJson(), xml:prettyPrint()