Database Reference
In-Depth Information
3. In the screenshot, you can see that there is one root object (
Audit
) and two child
objects (
Searches
and
Modify Splunk Configs
). If you click the
>
icon by each
object or child object, you can see the fields that are included in each of them, as
shown in the following screenshot:
Select a Data Object
4. If you click on the downward
V
icon next to each field, you can see the options
that are available to view the field in a pivot—
Top Values
or
Top Values by
Time
.
5. Click the downward
V
icon next to
info
and select
Top Values by Time
:
