How to create a dashboard search to output these specific fields in results?

[sujith0311]

What I'm trying to do is when I give input as index=sftp USER=gradydftsftp and it gives output as:

Jan 27 10:15:01 wmcloudsftp internal-sftp[9055]: session closed for local user gradydftsftpdata.
Jan 27 09:15:03 wmcloudsftp internal-sftp[4534]: session closed for local user gradydftsftpdata

So my question is, how can I create a dashboard with a search which displays
file name, uploadby, uploadtime, download, downloadby, and download time.

Filename is something like (9055)
uploadby is gradydftsftp
uploadtime is 09:15:03

[GregZillgitt]

Are you asking how to create a search that extracts fields from your events, or how to display the output of the search in a dashboard? Or both?

Obviously the logging you've shown is not sufficient to distinguish between uploads and downloads.

[somesoni2]

From the logs, how can we differentiate if its and upload or download?