When you need to surface relevant data quickly in a UDM search, which approach is most effective if default columns are not useful?

• A. Download as CSV and manipulate in a spreadsheet.
• B. Create a SIEM dashboard based on the search.
• C. Select events, choose UDM fields from event view checkboxes, copy/extract/analyze, refine query.
• D. Use the columns feature to select/remove columns relevant to your analysis.

Answer: (D)

Focusing on the data fields that matter and removing the rest lets you surface what you need in a UDM search much more quickly. The columns feature lets you pick exactly which fields are shown in your results and hide the others, so the results view becomes a concise, relevant view of the information you care about. This reduces visual noise and lets you spot the relevant signals right away, without exporting data or constructing dashboards.

Downloading to CSV and manipulating data adds steps and delays, and building a dashboard is more about long-term visualization than ad hoc quick-look analysis. Selecting specific events and copying fields is helpful in some workflows but is more manual and time-consuming. Tailoring the displayed columns directly in the search results gives you the fastest path to the needed data in the moment.