Displaying Fields

The Fields Panel on the left-hand side of the User Interface contains the following:

  • Columns lists those fields displayed in the results on the main Event List area. It must contain at least one column selected.

  • Fields lists all the other fields available for queries, which can be displayed by clicking +. Clicking the third column near each field will add a star (i.e., ★) and move the field to the top of known fields.

  • # indicates the number of distinct values observed for that field i.e., the field’s cardinality.

  • % indicates the percentage of events that have this field.

  • 🔄 resets columns and removes the ones previously added.

  • three-dot menu to trigger Field Interactions.

  • Filter Fields allows searching of a field by typing its name in the box.

  • Fetch more allows adding more events' fields than the 200 events displayed by default. It basically improves fields statistics to get fields in the Fields Panel that might not be in the events you are currently looking at.

Fields Panel

Figure 71. Fields Panel

The Fields Panel can be expanded or collapsed:

Expanding the Fields Panel

Figure 72. Expanding the Fields Panel