What is the easiest way to get headers on columns for raw data that is in list format? Here is what the raw data looks like. I am bit confused as to how this process works?
Wed Jun 29 2016 21:39:05 www1 sshd[3861]: Failed password for invalid user admin from 211.166.11.101 port 1256 ssh2
Thank you.
You have to extract fields
from the events
and then use table
to present them in a table. Something like this:
... | (?<timestamp>\w+\s+\w+\s+\d+\s+\d+\s+\d+:\d+:\d+)\s+(?<hostname>\w+)\s+\w+\[(?<pid>\d+)\]:\s+(?<message>.*?)\sfrom\s(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+port\s+(?<port>\d+)\s+(?<process_name>.*)$"
| table hostname PID message src_ip port process_name