FIELD_NAME=(field-name,...)

    Specifies the name of the field that was modified. ANALYZE/AUDIT
    uses the FIELD_NAME criterion with packets containing the
    original data and the new data (specified by the NEW_DATA
    criterion).

    A FIELD_NAME is a character string that describes the content
    of the field. A search for "NEW:" in a full audit report will
    display records that contain the FIELD_NAME values that can be
    specified for this option. Examples of FIELD_NAME values are
    Account, Default Directory, Flags, and Password Date.

    For sensitive information, see SENSITIVE_FIELD_NAME.