1
_time
3
authorization.action
5
authorization.scope
7
caller
9
channels
11
claims.aio
13
claims.altsecid
15
claims.appid
17
claims.appidacr
19
claims.aud
21
claims.exp
23
claims.groups
25
claims.http://schemas.microsoft.com/claims/authnclassreference
27
claims.http://schemas.microsoft.com/claims/authnmethodsreferences
29
claims.http://schemas.microsoft.com/identity/claims/identityprovider
31
claims.http://schemas.microsoft.com/identity/claims/objectidentifier
33
claims.http://schemas.microsoft.com/identity/claims/scope
35
claims.http://schemas.microsoft.com/identity/claims/tenantid
37
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
39
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
41
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
43
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
45
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
47
claims.iat
49
claims.ipaddr
51
claims.iss
53
claims.name
55
claims.nbf
57
claims.puid
59
claims.rh
61
claims.uti
63
claims.ver
65
claims.wids
67
claims.xms_tcdt
69
correlationId
71
date_hour
73
date_mday
75
date_minute
77
date_month
79
date_second
81
date_wday
83
date_year
85
date_zone
87
dest
89
dvc
91
eventDataId
93
eventName.localizedValue
95
eventName.value
97
eventSource.localizedValue
99
eventSource.value
101
eventTimestamp
103
host
105
id
107
index
109
level
111
linecount
113
object
115
object_id
117
object_path
119
operationId
121
operationName.localizedValue
123
operationName.value
125
product
127
properties.entity
129
properties.eventCategory
131
properties.hierarchy
133
properties.message
135
punct
137
resourceGroupName
139
resourceProviderName.localizedValue
141
resourceProviderName.value
143
resourceUri
145
source
147
sourcetype
149
splunk_server
151
status
153
status.localizedValue
155
status.value
157
subStatus.value
159
submissionTimestamp
161
subscriptionId
163
timeendpos
165
timestartpos
167
user
169
user_name
171
vendor
173
vendor_product
175
vendor_res_code
177
not set