What is the easiest way to get headers on columns for raw data that is in list format? Here is what the raw data looks like. I am bit confused as to how this process works?
Wed Jun 29 2016 21:39:05 www1 sshd: Failed password for invalid user admin from 220.127.116.11 port 1256 ssh2
You have to extract fields from the events and then use table to present them in a table. Something like this:
... | (?<timestamp>\w+\s+\w+\s+\d+\s+\d+\s+\d+:\d+:\d+)\s+(?<hostname>\w+)\s+\w+\[(?<pid>\d+)\]:\s+(?<message>.*?)\sfrom\s(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+port\s+(?<port>\d+)\s+(?<process_name>.*)$"
| table hostname PID message src_ip port process_name