QuestionQ6

VerifiedParsing and Normalization

Which field complies with the CrowdStrike Parsing Standard (CPS)?

Explanation

#event.dataset is a CPS-compliant parser tag. It identifies the specific dataset within an event.module; LogScale prefixes tagged fields with # after ingestion.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!