1
_time
3
authorization.action
5
authorization.scope
7
caller
9
channels
11
claims.aio
13
claims.altsecid
15
claims.appid
17
claims.appidacr
19
claims.aud
21
claims.exp
23
claims.groups
25
claims.http://schemas.microsoft.com/claims/authnclassreference
27
claims.http://schemas.microsoft.com/claims/authnmethodsreferences
29
claims.http://schemas.microsoft.com/identity/claims/identityprovider
31
claims.http://schemas.microsoft.com/identity/claims/objectidentifier
33
claims.http://schemas.microsoft.com/identity/claims/scope
35
claims.http://schemas.microsoft.com/identity/claims/tenantid
37
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
39
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
41
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
43
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
45
claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
47
claims.iat
49
claims.ipaddr
51
claims.iss
53
claims.name
55
claims.nbf
57
claims.puid
59
claims.rh
61
claims.uti
63
claims.ver
65
claims.wids
67
claims.xms_tcdt
69
correlationId
71
date_hour
73
date_mday
75
date_minute
77
date_month
79
date_second
81
date_wday
83
date_year
85
date_zone
87
dest
89
dvc
91
eventDataId
93
eventName.localizedValue
95
eventName.value
97
eventSource.localizedValue
99
eventSource.value
101
eventTimestamp
103
host
105
httpRequest.clientIpAddress
107
httpRequest.clientRequestId
109
httpRequest.method
111
id
113
index
115
level
117
linecount
119
object
121
object_id
123
object_path
125
operationId
127
operationName.localizedValue
129
operationName.value
131
product
133
properties.entity
135
properties.eventCategory
137
properties.hierarchy
139
properties.message
141
properties.serviceRequestId
143
properties.statusCode
145
punct
147
resourceGroupName
149
resourceProviderName.localizedValue
151
resourceProviderName.value
153
resourceUri
155
result
157
result_id
159
source
161
sourcetype
163
splunk_server
165
src
167
status
169
status.localizedValue
171
status.value
173
subStatus.localizedValue
175
subStatus.value
177
submissionTimestamp
179
subscriptionId
181
timeendpos
183
timestartpos
185
user
187
user_name
189
vendor
191
vendor_product
193
vendor_res_code
195
not set