Columns lists the fields shown in the Event list in the Results panel. You must select at least one column.

Fields lists all other fields available for queries. Click + to display these fields. Hover over a field allows you to: get a description, add a star (★) to mark it as favorite, copy the field name.

# indicates the number of distinct values observed for that field, which is the field cardinality.

% indicates the percentage of events that have this field.

+ adds the field to the currently displayed result.

- removes the field from the currently displayed result.

🔄 resets to default fields by removing any fields previously added.

⋮ three-dot menu that triggers Field Interactions.

Filter fields allows you to search for a field by typing its name.

Sample more allows you to show up to 5,000 fields from the latest events displayed.

Therefore, the data shown do not necessarily include all fields, as we do not look at all data: newer data is favored, so older data within your selected time interval is less likely to be returned.

Conversely, if the older and newer data have roughly the same fields, then the results are likely be accurate because the data is relatively uniform.

This behavior improves field statistics, as the fields presented in the Fields panel might not match the events you are currently viewing.

After you've used Sample more, the Re-run button is available for loading more sample fields from more events:

Figure 81. Showing More Sample Fields