Hi, I have a blob of text in both the title and description file, I've tried looking for how to seperate them when I am seraching but I have not found anything. It looks like
Question? NoIf yes, Question? N/ADoes this even do something? N/AIs the event a false positive? YesTicket number: N/ASource Unique Identifier (UI): Alert trigger time: Date/time UTCEvent start time: Date/time
etc
I would like it to look like this
Question? No
If yes, Question? N/A
Does this even do something? N/A
Is the event a false positive? Yes
Ticket number: N/A
Source Unique Identifier (UI):
Alert trigger time: Date/time UTC
Event start time: Date/time
The search I'm using is this
| inputlookup append=t investigative_canvas_entries_lookup
| table _time creator owner title description canvas_id
| sort -_time
... View more