Skip to content

Commit 9bae955

Browse files
authored
Update index.md
1 parent aed4e2d commit 9bae955

File tree

1 file changed

+9
-1
lines changed
  • docs/search/get-started-with-search/search-page/field-browser

1 file changed

+9
-1
lines changed

docs/search/get-started-with-search/search-page/field-browser/index.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,15 @@ The Field Browser is limited for aggregate queries in the following ways:
6767
* Field counts (item G above) are not displayed for aggregate queries. 
6868
* Field counts—If messages returned are less than or equal to 2500 messages, then an exact calculation is shown. If more than 2500 messages are returned, an approximation is shown.
6969
* The **Approximate Count** displays the count of the field values for the field. This does not display complete field values count for that field but it's just to calculate average, minimum, maximum, and standard deviation values from the first 100,000 raw messages. The field values will be skipped if the 100,000 raw messages limit is exceeded.
70-
70+
* You can limit the number of fields you extract. Use the below query to restrict the number of fields for field browser:
71+
```sql
72+
_sourceCategory="cnapp/palo_alto/cortex_cloud" and _collector="Cribl - Palo Alto Cortex Cloud (Prisma)" _dataTier=infrequent
73+
| json field=_raw "command" as Command
74+
| json field=_raw "image" as Image
75+
| json field=_raw "container" as container
76+
| fields container, Image, Command
77+
```
78+
7179
## Guide contents
7280

7381
In this section, we'll introduce the following concepts:

0 commit comments

Comments
 (0)