Hi there,
i am trying to figure out a way, to output results of an alert as a table into an external application e.g. a ticketing tool which has a "notes"-textbox which allows just plain text.
At the moment, i just send the raw logs by $result._raw$, but what i want to do is something like:
Query Example:
index=main sourcetype=WinEventLog:Security EventID IN (4624,4625)
| stats count by _time, user, EventID, host
DESIRED OUTPUT for the external Application:
+--------+-------+---------+----------+
| _time | user | EventID | host |
+--------+-------+---------+----------+
| time_1 | alice | 4625 | 10.0.0.5 |
| time_2 | bob | 4624 | 10.0.0.6 |
| time_3 | tom | 4624 | 10.0.0.7 |
+--------+-------+---------+----------+
Is this possible? First i thought mvcombine, but don´t now if such a pattern is possible?
Kind regards
ssd
I checked for the same today
The real implementation would be an add-on using python lib to do this nicely.
I try to do something in SPL, but a better padding would be needed 😜
``` code to add after your search ```
| foreach * [ eval mytitles_r_here=mvappend(mytitles_r_here,"<<FIELD>>"),
myrows_r_here=mvappend(myrows_r_here,'<<FIELD>>') ]
``` building lines with delimiters ```
| eval mytitles_r_here="| ".mvjoin(mytitles_r_here," | ")." |"
| eval myrows_r_here="| ".mvjoin(myrows_r_here," | ")." |"
| eval thisispadding=myrows_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval myrows_r_here = mvappend(thisispadding,myrows_r_here)
``` merging the rows```
| stats first(mytitles_r_here) AS mytitles_r_here
list(myrows_r_here) AS myrows_r_here
first(thisispadding) AS thisispadding
| eval myrows_r_here = mvappend(myrows_r_here,thisispadding)
``` merging with title```
| eval thisispadding=mytitles_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval this_is_the_result=mvappend(thisispadding,mytitles_r_here,myrows_r_here)
| table this_is_the_result