none
Fields greyed out? RRS feed

Answers

  • Please file those one by one in UserVoice as you spot them - 'please make field XYZ facetable' - and describe the query scenarios you need them for, just like you are doing here. The team will review them and possibly change those that make sense.
    Monday, June 29, 2015 7:47 AM

All replies

  • It means the field is in the full-text index, but it is not 'facetable': basically you can find its VALUEs such as

    "foo"

    3

    but you cannot do faceted queries against it, i.e.

    Field="foo"

    or

    Field>3

    Thursday, June 18, 2015 1:55 PM
  • Hi Daniele.  Why is it set up like this?

    Thursday, June 18, 2015 8:37 PM
  • Not sure for that particular field. Sounds like 'Workstation' is redundant with 'Computer' anyway?
    Friday, June 26, 2015 9:58 AM
  • Finding more fields like this.

    If I do

    Type=SecurityEvent EventID=4728 OR EventID=4729

    I find "MemberName" is greyed out. 

    In this case I was trying to find out all the security group membership changes for a specific user.

    Is it possible to get these fields changed to so we can run queries against them?

    (or is there a better way of doing this query?)

    Monday, June 29, 2015 2:51 AM
  • Please file those one by one in UserVoice as you spot them - 'please make field XYZ facetable' - and describe the query scenarios you need them for, just like you are doing here. The team will review them and possibly change those that make sense.
    Monday, June 29, 2015 7:47 AM