You can specify a fieldset that determines a group of search result fields to be displayed in the Events table. In the table, each field in the set can provide the 10 most and least common values. Multiple searches can share a fieldset. Search provides a default fieldset that contains the most common event fields. You can customize the default fieldset for individual searches, and you can add lookup list fields to a fieldset.
Select Search.
Select the name of the current fieldset (shown to the left of the time range selector).
By default, Search displays the name of the last used fieldset.
In the Fieldset Lists window, select Create New.
Select and/or deselect the desired fields.
To view the complete list of available fields, click View all.
To locate a specific field, use the search field.
To add fields from a lookup list, complete the following steps:
Select Lookup Lists.
Under the name of the desired lookup list, select the fields that you want to include.
Specify a name for the new fieldset.
Select Save.
Select Search.
Select the name of the current fieldset (shown to the left of the time range selector).
By default, Search displays the name of the last used fieldset.
If the last used fieldset is not the fieldset that you want to edit, select another fieldset from the drop-down menu.
Select Edit.
Select and/or deselect the desired fields.
When you remove a field from a fieldset, Search removes all filters and charts that use that field.
Change the name of the fieldset as needed.
Add lookup list fields as needed.
Select Save.
You must have Administrator permissions to perform this action.
You can create a default fieldset to provide a limited number of returned fields and thus improve the search response and performance. Minimizing the number of fields in the default fieldset will not compromise the required fields. When creating a default fieldset, review the following considerations:
Select a new fieldset other than the default Base Event Fields provided with the Search feature.
Only one fieldset can be designated as the default fieldset. There must be a default fieldset.
Saved fieldsets are the only ones that can be set as default.
Each fieldset should have a unique name.
Fieldset names are not case sensitive.
A default fieldset cannot be edited and saved under the original name.
You can delete a fieldset that you have created or that has not been designated as a default fieldset. If you delete a fieldset that’s used in an active search, Search changes the fieldset name to Custom for that search.
Select Search.
Select the name of the current fieldset (shown to the left of the time range selector).
By default, Search displays the name of the last used fieldset.
If the last used fieldset is not the fieldset that you want to delete, select another fieldset from the drop-down menu.
Select Edit this set.
Select Delete.