This message originated from Cribl Community Slack.
Click here to view the original link.
I was asked this today and I have absolutely what the answer is - why are some fields shaded with a different color in search?
Links for this message:
image.png
Solved
Field shading in Cribl Search indicates field coverage in data set
Best answer by paul925
Field coverage in the data set. The darker the shading, the more events contain that field
Short answer: grey/shaded rows = built-in fields, non-shaded rows = fields extracted from the data.
@user also note if you go to the "Fields" tab after running a Search, you'll see a more quantitative view of the Presence metric, which should make the shading clear.
NB: This is particularly helpful when your dataset is heterogeneous ie contains more than one Datatype.
Sign up
Already have an account? Login
Login to the community
No account yet? Create an account
Using your Cribl Curious or University Account
User Login Employee loginEnter your E-mail address. We'll send you an e-mail with instructions to reset your password.