Log Search

InsightIDR
1

Hi.

Is there a way in Log Search to only return the fields that I want to see?
For example, in the “Active Directory Admin Activity” index I only want to see the following fields in my table: “source_user” and “target_user”.
Is there a way to do this in the query or do I have to manually edit my table view (keys) in the settings?

2

Maybe this will help: Components for Building a Query | InsightIDR Documentation

3

Perfect, that worked!

I guess I missed that in the documentation.

4

Awesome! Glad it helped!