Hi there, i am trying to figure out a way, to output results of an alert as a table into an external application e.g. a ticketing tool which has a "notes"-textbox which allows just plain text.  At the moment, i just send the raw logs by $result._raw$, but what i want to do is something like: Query Example: index=main sourcetype=WinEventLog:Security EventID IN (4624,4625) | stats count by _time, user, EventID, host DESIRED OUTPUT for the external Application: +--------+-------+---------+----------+ | _time | user | EventID | host        | +--------+-------+---------+----------+ | time_1 | alice | 4625 | 10.0.0.5 |  | time_2 | bob |  4624  | 10.0.0.6 | | time_3 | tom |  4624  | 10.0.0.7 | +--------+-------+---------+----------+   Is this possible?  First i thought mvcombine, but don´t now if such a pattern is possible? Kind regards ssd ... View more