> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ListEventFieldValues

> Lists the known values of an event field, most frequent first.



## OpenAPI

````yaml openapi/api_v1_data_openapi3_DOCUMENTATION_ONLY.json GET /api/v1/data/events:field-values
openapi: 3.0.3
info:
  description: |

    The Data API provides HTTP/JSON REST endpoints for reading and writing data
    to the Chronosphere system.

    Use this link to download the raw Swagger specification:
    <a href="/api/v1/data/swagger.json">/api/v1/data/swagger.json</a>
  title: Data V1 API
  version: v1
servers:
  - url: https://{tenant}.chronosphere.io
    variables:
      tenant:
        default: tenant
        description: tenant ID assigned by the service provider
security:
  - ApiKeyAuth: []
tags:
  - name: DataV1
paths:
  /api/v1/data/events:field-values:
    get:
      tags:
        - DataV1
      description: Lists the known values of an event field, most frequent first.
      operationId: ListEventFieldValues
      parameters:
        - description: |-
            Field for which to list values.

             - CATEGORY: Event category.
             - TYPE: Event type.
             - SOURCE: Event source.
             - LABEL_NAME: Label name.
             - LABEL_VALUE: Label value.
             - LENS_SERVICE: Service associated with the event.
          in: query
          name: field
          schema:
            enum:
              - CATEGORY
              - TYPE
              - SOURCE
              - LABEL_NAME
              - LABEL_VALUE
              - LENS_SERVICE
            type: string
        - description: >-
            Label for which to list values. Required when `field` is
            `LABEL_VALUE`.

            Must be empty for every other field.
          in: query
          name: label_name
          schema:
            type: string
        - description: Event categories included in the scope.
          in: query
          name: scope.categories
          schema:
            items:
              type: string
            type: array
        - description: Event types included in the scope.
          in: query
          name: scope.types
          schema:
            items:
              type: string
            type: array
        - description: Event sources included in the scope.
          in: query
          name: scope.sources
          schema:
            items:
              type: string
            type: array
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/datav1ListEventFieldValuesResponse'
          description: A successful response.
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/googlerpcStatus'
          description: An unexpected error response.
components:
  schemas:
    datav1ListEventFieldValuesResponse:
      description: Response containing values for an event field.
      properties:
        values:
          description: >-
            Values ordered by descending frequency, with ties ordered
            alphabetically.
          items:
            type: string
          type: array
      type: object
    googlerpcStatus:
      properties:
        code:
          format: int32
          type: integer
        details:
          items:
            $ref: '#/components/schemas/protobufAny'
          type: array
        message:
          type: string
      type: object
    protobufAny:
      additionalProperties: {}
      properties:
        '@type':
          type: string
      type: object
  securitySchemes:
    ApiKeyAuth:
      description: Chronosphere API token
      in: header
      name: API-Token
      type: apiKey

````

## Related topics

- [ListEvents](/tooling/api-info/data_definition/operations/ListEvents.md)
- [Cortex XCOR MCP server tools](/integrate/mcp-server/resources.md)
- [Enable change events on dashboards](/observe/enable-events/dashboards.md)
- [Change event limits](/administer/limits-licensing/limits/event-limits.md)
- [ListExternalConnections](/tooling/api-info/definition/operations/ListExternalConnections.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.