CloudTrail Lake: values follow the select list

Position is the column

get-query-results returns each row as values in the order of the SELECT clause. The first value is the first selected expression, not “whatever looks like a time.” If the SELECT list is not stored with the values, a reader assigns columns by guess.

A time-shaped string is only eventTime if eventTime was selected in that position. An address-shaped string is only a source address if that expression was selected there.

The header is the SELECT text

Put the SELECT list in the note, in order, then the values in that order. If you flatten rows to a table, the header row has to be those expressions. A header you typed from memory is a different query than the one that ran.

When the query id is known, the statement you filed with that id is the header. Do not attach a statement from a different query id because the column count matches.

What to file

File the query id, the SELECT list, and the values in order. If the SELECT list was not saved, write “column names not recorded” and do not label the values. A labeled guess is worse than an unlabeled line, because it looks checked.

Worked case: an address read as an account

A lab row is pasted as three tokens: a time, 111122223333, and 203.0.113.10. The ticket calls 203.0.113.10 the account and 111122223333 the source address, because the author expected address first. The saved statement selects eventTime, userIdentity.accountId, sourceIPAddress, in that order.

The note puts the SELECT list above the tokens. 111122223333 is the account id. 203.0.113.10 is the source address. The swapped labels are removed. The query id stays on the note so the order can be checked.

Snippet

query id: q-77
SELECT eventTime, userIdentity.accountId, sourceIPAddress
values: 2026-11-03T17:12:00Z    111122223333    203.0.113.10
account: 111122223333
source address: 203.0.113.10
not: the address read as the account

Diagram

Label values from the SELECT list

Statement
The SELECT list, in order.
Query
```
eventTime, account id, source address
```
Values
One row, same order.
Result
```
time, 111122223333, 203.0.113.10
```
Names
Taken from that list, not from what the token looks like.
Note
```
the long number is the account
```
Missing list
Say the columns were not recorded.
Note
```
do not invent headers
```

Check yourself

1. What decides which value in a Lake row is the account id?

2. The SELECT list was not saved. What do you do with three pasted tokens?

3. Two queries return three columns. May you reuse the first statement as the header of the second?