> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/siem/advanced-settings/custom-fields.md).

# Custom Fields

Custom fields allow you to add further information to log entries in the [data lake](/docs/manual/english/platform-usage/siem/data-lake.md). You can use the fields you create as target fields in a custom [extractor](/docs/manual/english/platform-usage/siem/advanced-settings/extractors.md).

{% hint style="danger" %}
**Please note**: Once created, custom fields cannot be edited or deleted. Set a custom field to inactive if you no longer want to use it.
{% endhint %}

***

<i class="fa-compass">:compass:</i> Navigate to **SIEM** → **Custom Fields** to show a list of all fields you created. If you have not created a custom field yet, this view is empty.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FGxKsu5OgrPNwsq5lgiYV%2Fenginsight-screenshot-siem-advanced%20settings-custom%20fields.jpg?alt=media&amp;token=26489bf4-a601-4b10-9f42-8832be5b5810" alt=""><figcaption></figcaption></figure>

The [custom fields overview](#custom-fields-overview) provides information such as:

* the display name and actual field name of a custom field.
* the field type assigned to a custom field.
* whether a custom field is active and can be used in extractors.

You can also [add a new custom field](#add-custom-fields) and enable or disable custom fields.

***

## Navigation

<i class="fa-magnifying-glass">:magnifying-glass:</i> Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Refresh** icon <i class="fa-arrows-rotate-reverse">:arrows-rotate-reverse:</i> above the list to update all list items.

<i class="fa-computer-mouse-scrollwheel">:computer-mouse-scrollwheel:</i> Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages.&#x20;

### Sorting List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Sort** icon <i class="fa-sort">:sort:</i> next to a column name in the table header to sort by that column in ascending <i class="fa-angle-up">:angle-up:</i> or descending order <i class="fa-chevron-down">:chevron-down:</i> .

<i class="fa-computer-mouse">:computer-mouse:</i> Click the sort icon <i class="fa-bars-sort">:bars-sort:</i> above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority.

### Further Actions for List Items

<i class="fa-computer-mouse">:computer-mouse:</i> Select the checkbox <i class="fa-square">:square:</i> next to a list item to select the respective item. Alternatively, select the checkbox in the table header to select all list items.

The number of selected list items is now shown next to the search field.

The <i class="fa-slider">:slider:</i> **Actions** menu also appears in the upper-right corner. Click it to expand the respective submenu. The following actions are available:

<table><thead><tr><th width="149.84375">Action</th><th>Description</th></tr></thead><tbody><tr><td>Enable</td><td><p><i class="fa-eye">:eye:</i> This action is only available if all selected objects are inactive.</p><p></p><p>Enable all inactive objects.</p></td></tr><tr><td>Disable</td><td><i class="fa-eye">:eye:</i> This action is available only if all selected objects are active.<br><br>Disable all active objects.</td></tr></tbody></table>

***

## Custom Fields: Overview

The custom fields overview is structured as a table.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FITqJOD5MuAFSVglVbyPV%2Fenginsight-screenshot-siem-advanced%20settings-custom%20fields%20overview.jpg?alt=media&amp;token=0544d31a-f482-4bda-914c-ed1c25891f28" alt=""><figcaption></figcaption></figure>

The following information is shown:

<table><thead><tr><th width="200.03125">Column</th><th>Description</th></tr></thead><tbody><tr><td>Name</td><td><p>Shows the display name of the custom field and an additional description, if provided.</p><p></p><p>The date and time of creation and last edit are also shown.<br><br><i class="fa-computer-mouse">:computer-mouse:</i> Click the display name of a field to navigate to the respective <a href="#custom-fields-edit-view">edit view</a>. Here you can change the field's display name and description and view <a href="#field-statistics">field statistics</a>.</p></td></tr><tr><td>Field Name</td><td>Shows the actual name of the custom field.</td></tr><tr><td>Field Type</td><td><p>Shows the selected field type on which the custom field is based. The field type defines the type and structure of the data stored in the field.<br><br>The following field types can be shown:</p><ul><li><strong>Boolean</strong>: The returned field value is a Boolean value and is returned as <em>true</em> or <em>false</em>.</li><li><strong>PDate</strong>: The returned field value is a time value consisting of a date and time.</li><li><strong>PDouble</strong>: The returned field value is a 64-bit floating-point number.</li><li><strong>PFloat</strong>: The returned field value is a 32-bit floating-point number.</li><li><strong>PInt</strong>: The returned field value is a 32-bit integer.</li><li><strong>PLong</strong>: The returned field value is a 64-bit integer.</li><li><strong>String</strong>: The returned field value is a string encoded in UTF-8 or Unicode.</li><li><strong>Text_General</strong>: The returned field value is multiline text that is split into and stored as multiple words or tokens.</li></ul></td></tr><tr><td>Enabled</td><td>Shows whether the custom field is active and can be used in extractors, or not.<br><br>An enabled field is indicated by a green <strong>check</strong> icon <i class="fa-circle-check" style="color:green;">:circle-check:</i>. Disabled fields are indicated by a red <strong>circle</strong> icon <i class="fa-circle" style="color:red;">:circle:</i>.</td></tr></tbody></table>

***

## Adding a Custom Field

<i class="fa-computer-mouse">:computer-mouse:</i> Click <i class="fa-plus">:plus:</i> **Add Custom Field** in the upper-right corner to [create a new custom field](/docs/manual/english/platform-usage/siem/advanced-settings/custom-fields/add-custom-field.md).

***

## Custom Field: Edit View

<i class="fa-computer-mouse">:computer-mouse:</i> Click the display name of a field to navigate to the respective edit view.

{% hint style="warning" %}
**Please note**: In the edit view for custom fields, you can change only the display name and description.
{% endhint %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FuwNLKPFx6dUqJznk6X64%2Fenginsight-screenshot-siem-advanced%20settings-custom%20fields-edit%20view%20custom%20field.jpg?alt=media&amp;token=2d412f5f-e5dd-47d9-8031-aa92cee1d912" alt=""><figcaption></figcaption></figure>

The following actions are available:

<table><thead><tr><th width="200.39453125">Option</th><th>Description</th></tr></thead><tbody><tr><td>Save Changes</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Save Changes</strong> after changing any settings.</td></tr><tr><td>Back</td><td><i class="fa-computer-mouse">:computer-mouse:</i> Click <strong>Back</strong> to return to the list view.</td></tr></tbody></table>

### Field Statistics

The edit view for configured custom fields shows two line charts with measured values over time.

The first line chart shows the number of all measured field values over time. The second line chart shows the number of unique measured field values over time.

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FzEx5qYIJpEVcWJWhOg2g%2Fenginsight-screenshot-siem-advanced%20settings-custom%20fields-edit%20view%20field%20statistics.jpg?alt=media&amp;token=e7de3ed2-bca3-4b74-8e77-4d6a1905324f" alt=""><figcaption></figcaption></figure>

<i class="fa-arrow-pointer">:arrow-pointer:</i> Hover over a line in the chart to show the exact number of measured field values at a specific point in time.

***