I've got a saved search that's emailing me results up to this morning it was sending the results in a table with the fields I'd specified (with the fields command) in addition to _time and _raw.
This morning I decided to try and strip _time out of the table, and was unable to get _time out and keep the fields I wanted. I'm ok with that, more or less for now, but now instead of the table formatting it's all jumbled text that's hard to read. Is there a way to get the formatting back to the table?
This is the search:
process="sudo" incorrect | rex "(?i)^(?:[^:]*:){3}\s+(?P\w+)\s+:" | fields uid, host, COMMAND
... View more