malcolm_field_profile
Check which event dataset types contain a specific field to determine its availability for a given data type.
Instructions
Show which event.dataset types contain a specific field.
Helps determine if a field is available for a given data type. For example, zeek.ssl.server_name only exists in SSL records.
Args: field: The field name to profile. time_from: Start time. Omit = recent-only; pass a range for historical data. time_to: End time.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | ||
| time_to | No | ||
| time_from | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |