Cortex XDR XQL fields stage defines which fields are returned in the result set.
fields [-] <field_1> [as <name1>], <field_2> [as <name2>], ...
fieldstage identifies which fields are returned in the result set. If this stage is used, then subsequent stages can operate only on the fields identified by this stage.
Use a wildcard (*) to include all fields that match the pattern. Use a '-' to exclude a field from the result set.
asclause to set an alias for a field. If you use the
asclause, then subsequent stages must use that alias to refer to the field.
action_countryfield from all
xdr_datarecords where the
action_countryfield is both not null and not "-". Also include all fields with names that match
dataset = xdr_data | fields action_country as ac | fields event_* | fields - event_type | filter ac != null and ac != "-"
Recommended For You
Recommended videos not found.