display
Use display to show a specific field or fields in query results.
The display command
shows only the fields
you specify.
If your query contains multiple display commands,
the query results show only the field or fields
that you specified in the final display command.
Example: Display one field
The code snippet shows an example
of a query
that uses the parse command
to extract data
from @message
to create the extracted fields loggingType and loggingMessage.
The query returns all log events
where the values for loggingType are ERROR.
display shows only the values for loggingMessage
in the query results.
fields @message | parse @message "[*] *" as loggingType, loggingMessage | filter loggingType = "ERROR" | display loggingMessage
Tip
Use display
only once
in a query.
If you use display
more than once
in a query,
the query results show the field specified
in the last occurrence
of display command being used.