---
name: "auparse_find_field"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/auparse_find_field"
---

# auparse\_find\_field(3)

search for field name

## NAME

auparse\_find\_field - search for field name

## SYNOPSIS

**#include \<auparse.h\>**

**const char \* auparse\_find\_field(auparse\_state\_t \****au,***const***char***\*"***name);"*

## DESCRIPTION

auparse\_find\_field will scan all records in an event to find the first occurrence of the field name passed to it. Searching begins from the cursor's current position. The field name is stored for subsequent searching.

NOTE: auparse creates 2 pseudo fields that do not exist in the natural record for SELinux AVC and USER\_AVC decision and permissions. The field names are seresult and seperms respectively.

## RETURN VALUE

Returns NULL field not found. If an error occurs errno will be set. Otherwise, it returns a pointer to the text value associated with the field.

## SEE ALSO

[**auparse\_first\_record**(3)](/auparse_first_record/3.md), [**auparse\_find\_field\_next**(3)](/auparse_find_field_next/3.md).

## AUTHOR

Steve Grubb