Show available schemas
When you write a pipeline, you often reference field names. If you do not know the shape of your data, you can look up available schemas, i.e., the record types describing a table.
Many SQL databases have a SHOW TABLES
command to show all available table
names, and SHOW COLUMNS
to display the individual fiels of a given table.
Similarly, our show
operator offers the
ability for introspection. Use show fields
to display all schema fields, with
with one field per event:
show fields | where schema == "zeek.dns" | write json -c