Alerting

How to create something like a ASCII table for sending results into the notes section of an application?

ssd
Loves-to-Learn Everything

Hi there,

i am trying to figure out a way, to output results of an alert as a table into an external application e.g. a ticketing tool which has a "notes"-textbox which allows just plain text. 

At the moment, i just send the raw logs by $result._raw$, but what i want to do is something like:

Query Example:

index=main sourcetype=WinEventLog:Security EventID IN (4624,4625)

| stats count by _time, user, EventID, host

DESIRED OUTPUT for the external Application:

+--------+-------+---------+----------+
| _time | user | EventID | host        |
+--------+-------+---------+----------+
| time_1 | alice | 4625 | 10.0.0.5 | 
| time_2 | bob |  4624  | 10.0.0.6 |
| time_3 | tom |  4624  | 10.0.0.7 |
+--------+-------+---------+----------+

 

Is this possible?  First i thought mvcombine, but don´t now if such a pattern is possible?

Kind regards

ssd

Labels (1)
0 Karma

FloSwiip
Path Finder

I checked for the same today
The real implementation would be an add-on using python lib to do this nicely.

I try to do something in SPL, but a better padding would be needed :winking_face_with_tongue:

 

``` code to add after your search ```
| foreach * [ eval mytitles_r_here=mvappend(mytitles_r_here,"<<FIELD>>"),
                   myrows_r_here=mvappend(myrows_r_here,'<<FIELD>>') ]

``` building lines with delimiters ```
| eval mytitles_r_here="| ".mvjoin(mytitles_r_here," | ")." |"
| eval myrows_r_here="| ".mvjoin(myrows_r_here," | ")." |"
| eval thisispadding=myrows_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval myrows_r_here = mvappend(thisispadding,myrows_r_here)

``` merging the rows```
| stats first(mytitles_r_here) AS mytitles_r_here
        list(myrows_r_here) AS myrows_r_here
        first(thisispadding) AS thisispadding
| eval myrows_r_here = mvappend(myrows_r_here,thisispadding)

``` merging with title```
| eval thisispadding=mytitles_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval this_is_the_result=mvappend(thisispadding,mytitles_r_here,myrows_r_here)

| table this_is_the_result

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...