Fields

Collection of expression for SELECT fields.

Source

Show the username from auth/FSSO, or the username learnt from telemetry, or fallback to source IP address:

COALESCE(nullifna(`user`),nullifna(`unauthuser`),ipstr(`srcip`))
AS
user_src