How to create something like a ASCII table for sending results into the notes section of an application?

[ssd]

Hi there,

i am trying to figure out a way, to output results of an alert as a table into an external application e.g. a ticketing tool which has a "notes"-textbox which allows just plain text. 

At the moment, i just send the raw logs by $result._raw$, but what i want to do is something like:

Query Example:

index=main sourcetype=WinEventLog:Security EventID IN (4624,4625)

| stats count by _time, user, EventID, host

DESIRED OUTPUT for the external Application:

+--------+-------+---------+----------+
| _time | user | EventID | host        |
+--------+-------+---------+----------+
| time_1 | alice | 4625 | 10.0.0.5 | 
| time_2 | bob |  4624  | 10.0.0.6 |
| time_3 | tom |  4624  | 10.0.0.7 |
+--------+-------+---------+----------+

Is this possible?  First i thought mvcombine, but don´t now if such a pattern is possible?

Kind regards

ssd

[FloSwiip]

I checked for the same today
The real implementation would be an add-on using python lib to do this nicely.

I try to do something in SPL, but a better padding would be needed 😜

``` code to add after your search ```
| foreach * [ eval mytitles_r_here=mvappend(mytitles_r_here,"<<FIELD>>"),
                   myrows_r_here=mvappend(myrows_r_here,'<<FIELD>>') ]

``` building lines with delimiters ```
| eval mytitles_r_here="| ".mvjoin(mytitles_r_here," | ")." |"
| eval myrows_r_here="| ".mvjoin(myrows_r_here," | ")." |"
| eval thisispadding=myrows_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval myrows_r_here = mvappend(thisispadding,myrows_r_here)

``` merging the rows```
| stats first(mytitles_r_here) AS mytitles_r_here
        list(myrows_r_here) AS myrows_r_here
        first(thisispadding) AS thisispadding
| eval myrows_r_here = mvappend(myrows_r_here,thisispadding)

``` merging with title```
| eval thisispadding=mytitles_r_here | rex mode=sed field=thisispadding "s/[^|]/-/g"
| eval this_is_the_result=mvappend(thisispadding,mytitles_r_here,myrows_r_here)

| table this_is_the_result