Just like this e.g:
| from datamodel:Authentication
| extract
vs.
index=* source="XmlWineventlog:Security" tag=authentication NOT (user=*$ action=success )
The number of fields will not be the same, as extract does not add field aliases. Compared this with fieldsummary .
... View more
