How-To: Create a shorthand process lineage in the field processLineage

Note

โŒ› Article is more than two years old.

If you want to identify the source or trigger of an event but lack the necessary data, you can create a new field and set of values based on other fields in the existing data without having to re-ingest:

logscale
//First set a default value
| default(field=GrandParentBaseFileName, value="Unknown")
//Then create the string using the following format:
| format(format="%s > %s > %s", field=[GrandParentBaseFileName, ParentBaseFileName, FileName], as="processLineage")