How to access Null fields in Parsers

GaryBushey 

Hi, Thanks for your response

Actually yes, the system that is sending the data have a list of the fields it is sending, But when we pass the data through API to the Azure sentinel, Azure while parsing the data, changes the field names.

Like for eg. In our system we sent fields "name" --> then azure checked for the values of those fields

              --> If the values are null for all the events, then that field is removed

              --> If the field is not null, then that field is present in azure, with a new name say "name_s"

So our concern is, if the fields is removed by azure, how do we know whether that field will come with the name of "name_s" or "something_else"?,

so that we can then write column_ifexists('name_s','') or column_ifexists('something_else','')