Skip to content

Update index.md #5624

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update index.md #5624

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9bae955
Update index.md
JV0812 Jul 25, 2025
862944f
Update docs/search/get-started-with-search/search-page/field-browser/…
kimsauce Jul 28, 2025
80ef92c
Update docs/search/get-started-with-search/search-page/field-browser/…
kimsauce Jul 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion docs/search/get-started-with-search/search-page/field-browser/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,15 @@ The Field Browser is limited for aggregate queries in the following ways:
* Field counts (item G above) are not displayed for aggregate queries. 
* Field counts—If messages returned are less than or equal to 2500 messages, then an exact calculation is shown. If more than 2500 messages are returned, an approximation is shown.
* The **Approximate Count** displays the count of the field values for the field. This does not display complete field values count for that field but it's just to calculate average, minimum, maximum, and standard deviation values from the first 100,000 raw messages. The field values will be skipped if the 100,000 raw messages limit is exceeded.

* You can limit the number of fields you extract. Use the below query to restrict the number of fields for field browser:
```sql
_sourceCategory="cnapp/palo_alto/cortex_cloud" and _collector="Cribl - Palo Alto Cortex Cloud (Prisma)" _dataTier=infrequent
| json field=_raw "command" as Command
| json field=_raw "image" as Image
| json field=_raw "container" as container
| fields container, Image, Command
```

## Guide contents

In this section, we'll introduce the following concepts:
Expand Down