#!/bin/bash
# ideone boilerplate: run in temp dir
t=$(mktemp -d -t ideone.XXXXXXXX) || exit
trap 'rm -rf "$t"' ERR EXIT
cd "$t"
cat <<\: >first.csv
"@timestamp","@version","_id","_index","_type","ad.(fydibohf23spdlt)/cn","ad.</o","ad.EventRecordID","ad.InitiatorID","ad.InitiatorType","ad.Opcode","ad.ProcessID","ad.TargetSid","ad.ThreadID","ad.Version","ad.agentZoneName","ad.analyzedBy","ad.command","ad.completed","ad.customerName","ad.databaseTable","ad.description","ad.destinationHosts","ad.destinationZoneName","ad.deviceZoneName","ad.expired","ad.failed","ad.loginName","ad.maxMatches","ad.policyObject","ad.productVersion","ad.requestUrlFileName","ad.severityType","ad.sourceHost","ad.sourceIp","ad.sourceZoneName","ad.systemDeleted","ad.timeStamp","ad.totalComputers","agentAddress","agentHostName","agentId","agentMacAddress","agentReceiptTime","agentTimeZone","agentType","agentVersion","agentZoneURI","applicationProtocol","baseEventCount","bytesIn","bytesOut","categoryBehavior","categoryDeviceGroup","categoryDeviceType","categoryObject","categoryOutcome","categorySignificance","cefVersion","customerURI","destinationAddress","destinationDnsDomain","destinationHostName","destinationNtDomain","destinationProcessName","destinationServiceName","destinationTimeZone","destinationUserId","destinationUserName","destinationUserPrivileges","destinationZoneURI","deviceAction","deviceAddress","deviceCustomDate1","deviceCustomDate1Label","deviceCustomIPv6Address3","deviceCustomIPv6Address3Label","deviceCustomNumber1","deviceCustomNumber1Label","deviceCustomNumber2","deviceCustomNumber2Label","deviceCustomNumber3","deviceCustomNumber3Label","deviceCustomString1","deviceCustomString1Label","deviceCustomString2","deviceCustomString2Label","deviceCustomString3","deviceCustomString3Label","deviceCustomString4","deviceCustomString4Label","deviceCustomString5","deviceCustomString5Label","deviceCustomString6","deviceCustomString6Label","deviceEventCategory","deviceEventClassId","deviceHostName","deviceNtDomain","deviceProcessName","deviceProduct","deviceReceiptTime","deviceSeverity","deviceVendor","deviceVersion","deviceZoneURI","endTime","eventId","eventOutcome","externalId","facility","facility_label","fileName","fileType","flexString1Label","flexString2","geid","highlight","host","message","name","oldFileHash","priority","reason","requestClientApplication","requestMethod","requestUrl","severity","severity_label","sort","sourceAddress","sourceHostName","sourceNtDomain","sourceProcessName","sourceServiceName","sourceUserId","sourceUserName","sourceZoneURI","startTime","tags","type"
2021-07-27 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
:
cat <<\: >second.csv
"@timestamp","@version","_id","_index","_type","ad.EventRecordID","ad.InitiatorID","ad.InitiatorType","ad.Opcode","ad.ProcessID","ad.TargetSid","ad.ThreadID","ad.Version","ad.agentZoneName","ad.analyzedBy","ad.command","ad.completed","ad.customerName","ad.databaseTable","ad.description","ad.destinationHosts","ad.destinationZoneName","ad.deviceZoneName","ad.expired","ad.failed","ad.loginName","ad.maxMatches","ad.policyObject","ad.productVersion","ad.requestUrlFileName","ad.severityType","ad.sourceHost","ad.sourceIp","ad.sourceZoneName","ad.systemDeleted","ad.timeStamp","agentAddress","agentHostName","agentId","agentMacAddress","agentReceiptTime","agentTimeZone","agentType","agentVersion","agentZoneURI","applicationProtocol","baseEventCount","bytesIn","bytesOut","categoryBehavior","categoryDeviceGroup","categoryDeviceType","categoryObject","categoryOutcome","categorySignificance","cefVersion","customerURI","destinationAddress","destinationDnsDomain","destinationHostName","destinationNtDomain","destinationProcessName","destinationServiceName","destinationTimeZone","destinationUserId","destinationUserName","destinationZoneURI","deviceAction","deviceAddress","deviceCustomDate1","deviceCustomDate1Label","deviceCustomIPv6Address3","deviceCustomIPv6Address3Label","deviceCustomNumber1","deviceCustomNumber1Label","deviceCustomNumber2","deviceCustomNumber2Label","deviceCustomNumber3","deviceCustomNumber3Label","deviceCustomString1","deviceCustomString1Label","deviceCustomString2","deviceCustomString2Label","deviceCustomString3","deviceCustomString3Label","deviceCustomString4","deviceCustomString4Label","deviceCustomString5","deviceCustomString5Label","deviceCustomString6","deviceCustomString6Label","deviceEventCategory","deviceEventClassId","deviceHostName","deviceNtDomain","deviceProcessName","deviceProduct","deviceReceiptTime","deviceSeverity","deviceVendor","deviceVersion","deviceZoneURI","endTime","eventId","eventOutcome","externalId","facility","facility_label","fileName","fileType","flexString1Label","flexString2","geid","highlight","host","message","name","oldFileHash","priority","reason","requestClientApplication","requestMethod","requestUrl","severity","severity_label","sort","sourceAddress","sourceHostName","sourceNtDomain","sourceProcessName","sourceServiceName","sourceUserId","sourceUserName","sourceZoneURI","startTime","tags","type"
2021-07-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
:
cat <<\: >third.csv
"@timestamp","@version","_id","_index","_type","ad.EventRecordID","ad.InitiatorID","ad.InitiatorType","ad.Opcode","ad.ProcessID","ad.TargetSid","ad.ThreadID","ad.Version","ad.agentZoneName","ad.analyzedBy","ad.command","ad.completed","ad.customerName","ad.databaseTable","ad.description","ad.destinationHosts","ad.destinationZoneName","ad.deviceZoneName","ad.expired","ad.failed","ad.loginName","ad.maxMatches","ad.policyObject","ad.productVersion","ad.requestUrlFileName","ad.severityType","ad.sourceHost","ad.sourceIp","ad.sourceZoneName","ad.systemDeleted","ad.timeStamp","agentAddress","agentHostName","agentId","agentMacAddress","agentReceiptTime","agentTimeZone","agentType","agentVersion","agentZoneURI","applicationProtocol","baseEventCount","bytesIn","bytesOut","categoryBehavior","categoryDeviceGroup","categoryDeviceType","categoryObject","categoryOutcome","categorySignificance","cefVersion","customerURI","destinationAddress","destinationDnsDomain","destinationHostName","destinationNtDomain","destinationProcessName","destinationServiceName","destinationTimeZone","destinationUserId","destinationUserName","destinationZoneURI","deviceAction","deviceAddress","deviceCustomDate1","deviceCustomDate1Label","deviceCustomIPv6Address3","deviceCustomIPv6Address3Label","deviceCustomNumber1","deviceCustomNumber1Label","deviceCustomNumber2","deviceCustomNumber2Label","deviceCustomNumber3","deviceCustomNumber3Label","deviceCustomString1","deviceCustomString1Label","deviceCustomString2","deviceCustomString2Label","deviceCustomString3","deviceCustomString3Label","deviceCustomString4","deviceCustomString4Label","deviceCustomString5","deviceCustomString5Label","deviceCustomString6","deviceCustomString6Label","deviceEventCategory","deviceEventClassId","deviceHostName","deviceNtDomain","deviceProcessName","deviceProduct","deviceReceiptTime","deviceSeverity","deviceVendor","deviceVersion","deviceZoneURI","endTime","eventId","eventOutcome","externalId","facility","facility_label","fileName","fileType","flexString1Label","flexString2","geid","highlight","host","message","name","oldFileHash","priority","reason","requestClientApplication","requestMethod","requestUrl","severity","severity_label","sort","sourceAddress","sourceHostName","sourceNtDomain","sourceProcessName","sourceServiceName","sourceUserId","sourceUserName","sourceZoneURI","startTime","tags","type"
2021-08-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
:
cat <<\: >ultimate.csv
"@timestamp","@version","_id","_index","_type","ad.EventRecordID","ad.InitiatorID","ad.InitiatorType","ad.Opcode","ad.ProcessID","ad.TargetSid","ad.ThreadID","ad.Version","ad.agentZoneName","ad.analyzedBy","ad.command","ad.completed","ad.customerName","ad.databaseTable","ad.description","ad.destinationHosts","ad.destinationZoneName","ad.deviceZoneName","ad.expired","ad.failed","ad.loginName","ad.maxMatches","ad.policyObject","ad.productVersion","ad.requestUrlFileName","ad.severityType","ad.sourceHost","ad.sourceIp","ad.sourceZoneName","ad.systemDeleted","ad.timeStamp","agentAddress","agentHostName","agentId","agentMacAddress","agentReceiptTime","agentTimeZone","agentType","agentVersion","agentZoneURI","applicationProtocol","baseEventCount","bytesIn","bytesOut","categoryBehavior","categoryDeviceGroup","categoryDeviceType","categoryObject","categoryOutcome","categorySignificance","cefVersion","customerURI","destinationAddress","destinationDnsDomain","destinationHostName","destinationNtDomain","destinationProcessName","destinationServiceName","destinationTimeZone","destinationUserId","destinationUserName","destinationZoneURI","deviceAction","deviceAddress","deviceCustomDate1","deviceCustomDate1Label","deviceCustomIPv6Address3","deviceCustomIPv6Address3Label","deviceCustomNumber1","deviceCustomNumber1Label","deviceCustomNumber2","deviceCustomNumber2Label","deviceCustomNumber3","deviceCustomNumber3Label","deviceCustomString1","deviceCustomString1Label","deviceCustomString2","deviceCustomString2Label","deviceCustomString3","deviceCustomString3Label","deviceCustomString4","deviceCustomString4Label","deviceCustomString5","deviceCustomString5Label","deviceCustomString6","deviceCustomString6Label","deviceEventCategory","deviceEventClassId","deviceHostName","deviceNtDomain","deviceProcessName","deviceProduct","deviceReceiptTime","deviceSeverity","deviceVendor","deviceVersion","deviceZoneURI","endTime","eventId","eventOutcome","externalId","facility","facility_label","fileName","fileType","flexString1Label","flexString2","geid","highlight","host","message","name","oldFileHash","priority","reason","requestClientApplication","requestMethod","requestUrl","severity","severity_label","sort","sourceAddress","sourceHostName","sourceNtDomain","sourceProcessName","sourceServiceName","sourceUserId","sourceUserName","sourceZoneURI","startTime","tags","type"
2021-08-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
:
cat <<\: >merge.py
import csv
import sys
fields = 0
for filename in sys.argv[1:]:
with open(filename) as raw:
for row in csv.reader(raw):
if len(row) > fields:
fields = len(row)
titles = row
break
writer = csv.writer(sys.stdout)
writer.writerow(titles)
for filename in sys.argv[1:]:
with open(filename) as raw:
for idx, row in enumerate(csv.reader(raw)):
if idx == 0:
next
row.extend([''] * (fields - len(row)))
writer.writerow(row)
:
awk -F ',' 'FNR == 1 { print NF, FILENAME; n = NF }
NF != n { print FILENAME ":" FNR ": wrong number of fields " NF " (expected " n ")" }' *.csv
python3 merge.py *.csv
IyEvYmluL2Jhc2gKCiMgaWRlb25lIGJvaWxlcnBsYXRlOiBydW4gaW4gdGVtcCBkaXIKdD0kKG1rdGVtcCAtZCAtdCBpZGVvbmUuWFhYWFhYWFgpIHx8IGV4aXQKdHJhcCAncm0gLXJmICIkdCInIEVSUiBFWElUCmNkICIkdCIKCmNhdCA8PFw6ID5maXJzdC5jc3YKIkB0aW1lc3RhbXAiLCJAdmVyc2lvbiIsIl9pZCIsIl9pbmRleCIsIl90eXBlIiwiYWQuKGZ5ZGlib2hmMjNzcGRsdCkvY24iLCJhZC48L28iLCJhZC5FdmVudFJlY29yZElEIiwiYWQuSW5pdGlhdG9ySUQiLCJhZC5Jbml0aWF0b3JUeXBlIiwiYWQuT3Bjb2RlIiwiYWQuUHJvY2Vzc0lEIiwiYWQuVGFyZ2V0U2lkIiwiYWQuVGhyZWFkSUQiLCJhZC5WZXJzaW9uIiwiYWQuYWdlbnRab25lTmFtZSIsImFkLmFuYWx5emVkQnkiLCJhZC5jb21tYW5kIiwiYWQuY29tcGxldGVkIiwiYWQuY3VzdG9tZXJOYW1lIiwiYWQuZGF0YWJhc2VUYWJsZSIsImFkLmRlc2NyaXB0aW9uIiwiYWQuZGVzdGluYXRpb25Ib3N0cyIsImFkLmRlc3RpbmF0aW9uWm9uZU5hbWUiLCJhZC5kZXZpY2Vab25lTmFtZSIsImFkLmV4cGlyZWQiLCJhZC5mYWlsZWQiLCJhZC5sb2dpbk5hbWUiLCJhZC5tYXhNYXRjaGVzIiwiYWQucG9saWN5T2JqZWN0IiwiYWQucHJvZHVjdFZlcnNpb24iLCJhZC5yZXF1ZXN0VXJsRmlsZU5hbWUiLCJhZC5zZXZlcml0eVR5cGUiLCJhZC5zb3VyY2VIb3N0IiwiYWQuc291cmNlSXAiLCJhZC5zb3VyY2Vab25lTmFtZSIsImFkLnN5c3RlbURlbGV0ZWQiLCJhZC50aW1lU3RhbXAiLCJhZC50b3RhbENvbXB1dGVycyIsImFnZW50QWRkcmVzcyIsImFnZW50SG9zdE5hbWUiLCJhZ2VudElkIiwiYWdlbnRNYWNBZGRyZXNzIiwiYWdlbnRSZWNlaXB0VGltZSIsImFnZW50VGltZVpvbmUiLCJhZ2VudFR5cGUiLCJhZ2VudFZlcnNpb24iLCJhZ2VudFpvbmVVUkkiLCJhcHBsaWNhdGlvblByb3RvY29sIiwiYmFzZUV2ZW50Q291bnQiLCJieXRlc0luIiwiYnl0ZXNPdXQiLCJjYXRlZ29yeUJlaGF2aW9yIiwiY2F0ZWdvcnlEZXZpY2VHcm91cCIsImNhdGVnb3J5RGV2aWNlVHlwZSIsImNhdGVnb3J5T2JqZWN0IiwiY2F0ZWdvcnlPdXRjb21lIiwiY2F0ZWdvcnlTaWduaWZpY2FuY2UiLCJjZWZWZXJzaW9uIiwiY3VzdG9tZXJVUkkiLCJkZXN0aW5hdGlvbkFkZHJlc3MiLCJkZXN0aW5hdGlvbkRuc0RvbWFpbiIsImRlc3RpbmF0aW9uSG9zdE5hbWUiLCJkZXN0aW5hdGlvbk50RG9tYWluIiwiZGVzdGluYXRpb25Qcm9jZXNzTmFtZSIsImRlc3RpbmF0aW9uU2VydmljZU5hbWUiLCJkZXN0aW5hdGlvblRpbWVab25lIiwiZGVzdGluYXRpb25Vc2VySWQiLCJkZXN0aW5hdGlvblVzZXJOYW1lIiwiZGVzdGluYXRpb25Vc2VyUHJpdmlsZWdlcyIsImRlc3RpbmF0aW9uWm9uZVVSSSIsImRldmljZUFjdGlvbiIsImRldmljZUFkZHJlc3MiLCJkZXZpY2VDdXN0b21EYXRlMSIsImRldmljZUN1c3RvbURhdGUxTGFiZWwiLCJkZXZpY2VDdXN0b21JUHY2QWRkcmVzczMiLCJkZXZpY2VDdXN0b21JUHY2QWRkcmVzczNMYWJlbCIsImRldmljZUN1c3RvbU51bWJlcjEiLCJkZXZpY2VDdXN0b21OdW1iZXIxTGFiZWwiLCJkZXZpY2VDdXN0b21OdW1iZXIyIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMkxhYmVsIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMyIsImRldmljZUN1c3RvbU51bWJlcjNMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzEiLCJkZXZpY2VDdXN0b21TdHJpbmcxTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmcyIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMkxhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMyIsImRldmljZUN1c3RvbVN0cmluZzNMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzQiLCJkZXZpY2VDdXN0b21TdHJpbmc0TGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmc1IiwiZGV2aWNlQ3VzdG9tU3RyaW5nNUxhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nNiIsImRldmljZUN1c3RvbVN0cmluZzZMYWJlbCIsImRldmljZUV2ZW50Q2F0ZWdvcnkiLCJkZXZpY2VFdmVudENsYXNzSWQiLCJkZXZpY2VIb3N0TmFtZSIsImRldmljZU50RG9tYWluIiwiZGV2aWNlUHJvY2Vzc05hbWUiLCJkZXZpY2VQcm9kdWN0IiwiZGV2aWNlUmVjZWlwdFRpbWUiLCJkZXZpY2VTZXZlcml0eSIsImRldmljZVZlbmRvciIsImRldmljZVZlcnNpb24iLCJkZXZpY2Vab25lVVJJIiwiZW5kVGltZSIsImV2ZW50SWQiLCJldmVudE91dGNvbWUiLCJleHRlcm5hbElkIiwiZmFjaWxpdHkiLCJmYWNpbGl0eV9sYWJlbCIsImZpbGVOYW1lIiwiZmlsZVR5cGUiLCJmbGV4U3RyaW5nMUxhYmVsIiwiZmxleFN0cmluZzIiLCJnZWlkIiwiaGlnaGxpZ2h0IiwiaG9zdCIsIm1lc3NhZ2UiLCJuYW1lIiwib2xkRmlsZUhhc2giLCJwcmlvcml0eSIsInJlYXNvbiIsInJlcXVlc3RDbGllbnRBcHBsaWNhdGlvbiIsInJlcXVlc3RNZXRob2QiLCJyZXF1ZXN0VXJsIiwic2V2ZXJpdHkiLCJzZXZlcml0eV9sYWJlbCIsInNvcnQiLCJzb3VyY2VBZGRyZXNzIiwic291cmNlSG9zdE5hbWUiLCJzb3VyY2VOdERvbWFpbiIsInNvdXJjZVByb2Nlc3NOYW1lIiwic291cmNlU2VydmljZU5hbWUiLCJzb3VyY2VVc2VySWQiLCJzb3VyY2VVc2VyTmFtZSIsInNvdXJjZVpvbmVVUkkiLCJzdGFydFRpbWUiLCJ0YWdzIiwidHlwZSIKMjAyMS0wNy0yNyAxNDoxMTozOSwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwKOgoKY2F0IDw8XDogPnNlY29uZC5jc3YKIkB0aW1lc3RhbXAiLCJAdmVyc2lvbiIsIl9pZCIsIl9pbmRleCIsIl90eXBlIiwiYWQuRXZlbnRSZWNvcmRJRCIsImFkLkluaXRpYXRvcklEIiwiYWQuSW5pdGlhdG9yVHlwZSIsImFkLk9wY29kZSIsImFkLlByb2Nlc3NJRCIsImFkLlRhcmdldFNpZCIsImFkLlRocmVhZElEIiwiYWQuVmVyc2lvbiIsImFkLmFnZW50Wm9uZU5hbWUiLCJhZC5hbmFseXplZEJ5IiwiYWQuY29tbWFuZCIsImFkLmNvbXBsZXRlZCIsImFkLmN1c3RvbWVyTmFtZSIsImFkLmRhdGFiYXNlVGFibGUiLCJhZC5kZXNjcmlwdGlvbiIsImFkLmRlc3RpbmF0aW9uSG9zdHMiLCJhZC5kZXN0aW5hdGlvblpvbmVOYW1lIiwiYWQuZGV2aWNlWm9uZU5hbWUiLCJhZC5leHBpcmVkIiwiYWQuZmFpbGVkIiwiYWQubG9naW5OYW1lIiwiYWQubWF4TWF0Y2hlcyIsImFkLnBvbGljeU9iamVjdCIsImFkLnByb2R1Y3RWZXJzaW9uIiwiYWQucmVxdWVzdFVybEZpbGVOYW1lIiwiYWQuc2V2ZXJpdHlUeXBlIiwiYWQuc291cmNlSG9zdCIsImFkLnNvdXJjZUlwIiwiYWQuc291cmNlWm9uZU5hbWUiLCJhZC5zeXN0ZW1EZWxldGVkIiwiYWQudGltZVN0YW1wIiwiYWdlbnRBZGRyZXNzIiwiYWdlbnRIb3N0TmFtZSIsImFnZW50SWQiLCJhZ2VudE1hY0FkZHJlc3MiLCJhZ2VudFJlY2VpcHRUaW1lIiwiYWdlbnRUaW1lWm9uZSIsImFnZW50VHlwZSIsImFnZW50VmVyc2lvbiIsImFnZW50Wm9uZVVSSSIsImFwcGxpY2F0aW9uUHJvdG9jb2wiLCJiYXNlRXZlbnRDb3VudCIsImJ5dGVzSW4iLCJieXRlc091dCIsImNhdGVnb3J5QmVoYXZpb3IiLCJjYXRlZ29yeURldmljZUdyb3VwIiwiY2F0ZWdvcnlEZXZpY2VUeXBlIiwiY2F0ZWdvcnlPYmplY3QiLCJjYXRlZ29yeU91dGNvbWUiLCJjYXRlZ29yeVNpZ25pZmljYW5jZSIsImNlZlZlcnNpb24iLCJjdXN0b21lclVSSSIsImRlc3RpbmF0aW9uQWRkcmVzcyIsImRlc3RpbmF0aW9uRG5zRG9tYWluIiwiZGVzdGluYXRpb25Ib3N0TmFtZSIsImRlc3RpbmF0aW9uTnREb21haW4iLCJkZXN0aW5hdGlvblByb2Nlc3NOYW1lIiwiZGVzdGluYXRpb25TZXJ2aWNlTmFtZSIsImRlc3RpbmF0aW9uVGltZVpvbmUiLCJkZXN0aW5hdGlvblVzZXJJZCIsImRlc3RpbmF0aW9uVXNlck5hbWUiLCJkZXN0aW5hdGlvblpvbmVVUkkiLCJkZXZpY2VBY3Rpb24iLCJkZXZpY2VBZGRyZXNzIiwiZGV2aWNlQ3VzdG9tRGF0ZTEiLCJkZXZpY2VDdXN0b21EYXRlMUxhYmVsIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzTGFiZWwiLCJkZXZpY2VDdXN0b21OdW1iZXIxIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMUxhYmVsIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMiIsImRldmljZUN1c3RvbU51bWJlcjJMYWJlbCIsImRldmljZUN1c3RvbU51bWJlcjMiLCJkZXZpY2VDdXN0b21OdW1iZXIzTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmcxIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMUxhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMiIsImRldmljZUN1c3RvbVN0cmluZzJMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzMiLCJkZXZpY2VDdXN0b21TdHJpbmczTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmc0IiwiZGV2aWNlQ3VzdG9tU3RyaW5nNExhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nNSIsImRldmljZUN1c3RvbVN0cmluZzVMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzYiLCJkZXZpY2VDdXN0b21TdHJpbmc2TGFiZWwiLCJkZXZpY2VFdmVudENhdGVnb3J5IiwiZGV2aWNlRXZlbnRDbGFzc0lkIiwiZGV2aWNlSG9zdE5hbWUiLCJkZXZpY2VOdERvbWFpbiIsImRldmljZVByb2Nlc3NOYW1lIiwiZGV2aWNlUHJvZHVjdCIsImRldmljZVJlY2VpcHRUaW1lIiwiZGV2aWNlU2V2ZXJpdHkiLCJkZXZpY2VWZW5kb3IiLCJkZXZpY2VWZXJzaW9uIiwiZGV2aWNlWm9uZVVSSSIsImVuZFRpbWUiLCJldmVudElkIiwiZXZlbnRPdXRjb21lIiwiZXh0ZXJuYWxJZCIsImZhY2lsaXR5IiwiZmFjaWxpdHlfbGFiZWwiLCJmaWxlTmFtZSIsImZpbGVUeXBlIiwiZmxleFN0cmluZzFMYWJlbCIsImZsZXhTdHJpbmcyIiwiZ2VpZCIsImhpZ2hsaWdodCIsImhvc3QiLCJtZXNzYWdlIiwibmFtZSIsIm9sZEZpbGVIYXNoIiwicHJpb3JpdHkiLCJyZWFzb24iLCJyZXF1ZXN0Q2xpZW50QXBwbGljYXRpb24iLCJyZXF1ZXN0TWV0aG9kIiwicmVxdWVzdFVybCIsInNldmVyaXR5Iiwic2V2ZXJpdHlfbGFiZWwiLCJzb3J0Iiwic291cmNlQWRkcmVzcyIsInNvdXJjZUhvc3ROYW1lIiwic291cmNlTnREb21haW4iLCJzb3VyY2VQcm9jZXNzTmFtZSIsInNvdXJjZVNlcnZpY2VOYW1lIiwic291cmNlVXNlcklkIiwic291cmNlVXNlck5hbWUiLCJzb3VyY2Vab25lVVJJIiwic3RhcnRUaW1lIiwidGFncyIsInR5cGUiCjIwMjEtMDctMjggMTQ6MTE6MzksLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsCjoKCmNhdCA8PFw6ID50aGlyZC5jc3YKIkB0aW1lc3RhbXAiLCJAdmVyc2lvbiIsIl9pZCIsIl9pbmRleCIsIl90eXBlIiwiYWQuRXZlbnRSZWNvcmRJRCIsImFkLkluaXRpYXRvcklEIiwiYWQuSW5pdGlhdG9yVHlwZSIsImFkLk9wY29kZSIsImFkLlByb2Nlc3NJRCIsImFkLlRhcmdldFNpZCIsImFkLlRocmVhZElEIiwiYWQuVmVyc2lvbiIsImFkLmFnZW50Wm9uZU5hbWUiLCJhZC5hbmFseXplZEJ5IiwiYWQuY29tbWFuZCIsImFkLmNvbXBsZXRlZCIsImFkLmN1c3RvbWVyTmFtZSIsImFkLmRhdGFiYXNlVGFibGUiLCJhZC5kZXNjcmlwdGlvbiIsImFkLmRlc3RpbmF0aW9uSG9zdHMiLCJhZC5kZXN0aW5hdGlvblpvbmVOYW1lIiwiYWQuZGV2aWNlWm9uZU5hbWUiLCJhZC5leHBpcmVkIiwiYWQuZmFpbGVkIiwiYWQubG9naW5OYW1lIiwiYWQubWF4TWF0Y2hlcyIsImFkLnBvbGljeU9iamVjdCIsImFkLnByb2R1Y3RWZXJzaW9uIiwiYWQucmVxdWVzdFVybEZpbGVOYW1lIiwiYWQuc2V2ZXJpdHlUeXBlIiwiYWQuc291cmNlSG9zdCIsImFkLnNvdXJjZUlwIiwiYWQuc291cmNlWm9uZU5hbWUiLCJhZC5zeXN0ZW1EZWxldGVkIiwiYWQudGltZVN0YW1wIiwiYWdlbnRBZGRyZXNzIiwiYWdlbnRIb3N0TmFtZSIsImFnZW50SWQiLCJhZ2VudE1hY0FkZHJlc3MiLCJhZ2VudFJlY2VpcHRUaW1lIiwiYWdlbnRUaW1lWm9uZSIsImFnZW50VHlwZSIsImFnZW50VmVyc2lvbiIsImFnZW50Wm9uZVVSSSIsImFwcGxpY2F0aW9uUHJvdG9jb2wiLCJiYXNlRXZlbnRDb3VudCIsImJ5dGVzSW4iLCJieXRlc091dCIsImNhdGVnb3J5QmVoYXZpb3IiLCJjYXRlZ29yeURldmljZUdyb3VwIiwiY2F0ZWdvcnlEZXZpY2VUeXBlIiwiY2F0ZWdvcnlPYmplY3QiLCJjYXRlZ29yeU91dGNvbWUiLCJjYXRlZ29yeVNpZ25pZmljYW5jZSIsImNlZlZlcnNpb24iLCJjdXN0b21lclVSSSIsImRlc3RpbmF0aW9uQWRkcmVzcyIsImRlc3RpbmF0aW9uRG5zRG9tYWluIiwiZGVzdGluYXRpb25Ib3N0TmFtZSIsImRlc3RpbmF0aW9uTnREb21haW4iLCJkZXN0aW5hdGlvblByb2Nlc3NOYW1lIiwiZGVzdGluYXRpb25TZXJ2aWNlTmFtZSIsImRlc3RpbmF0aW9uVGltZVpvbmUiLCJkZXN0aW5hdGlvblVzZXJJZCIsImRlc3RpbmF0aW9uVXNlck5hbWUiLCJkZXN0aW5hdGlvblpvbmVVUkkiLCJkZXZpY2VBY3Rpb24iLCJkZXZpY2VBZGRyZXNzIiwiZGV2aWNlQ3VzdG9tRGF0ZTEiLCJkZXZpY2VDdXN0b21EYXRlMUxhYmVsIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzTGFiZWwiLCJkZXZpY2VDdXN0b21OdW1iZXIxIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMUxhYmVsIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMiIsImRldmljZUN1c3RvbU51bWJlcjJMYWJlbCIsImRldmljZUN1c3RvbU51bWJlcjMiLCJkZXZpY2VDdXN0b21OdW1iZXIzTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmcxIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMUxhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMiIsImRldmljZUN1c3RvbVN0cmluZzJMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzMiLCJkZXZpY2VDdXN0b21TdHJpbmczTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmc0IiwiZGV2aWNlQ3VzdG9tU3RyaW5nNExhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nNSIsImRldmljZUN1c3RvbVN0cmluZzVMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzYiLCJkZXZpY2VDdXN0b21TdHJpbmc2TGFiZWwiLCJkZXZpY2VFdmVudENhdGVnb3J5IiwiZGV2aWNlRXZlbnRDbGFzc0lkIiwiZGV2aWNlSG9zdE5hbWUiLCJkZXZpY2VOdERvbWFpbiIsImRldmljZVByb2Nlc3NOYW1lIiwiZGV2aWNlUHJvZHVjdCIsImRldmljZVJlY2VpcHRUaW1lIiwiZGV2aWNlU2V2ZXJpdHkiLCJkZXZpY2VWZW5kb3IiLCJkZXZpY2VWZXJzaW9uIiwiZGV2aWNlWm9uZVVSSSIsImVuZFRpbWUiLCJldmVudElkIiwiZXZlbnRPdXRjb21lIiwiZXh0ZXJuYWxJZCIsImZhY2lsaXR5IiwiZmFjaWxpdHlfbGFiZWwiLCJmaWxlTmFtZSIsImZpbGVUeXBlIiwiZmxleFN0cmluZzFMYWJlbCIsImZsZXhTdHJpbmcyIiwiZ2VpZCIsImhpZ2hsaWdodCIsImhvc3QiLCJtZXNzYWdlIiwibmFtZSIsIm9sZEZpbGVIYXNoIiwicHJpb3JpdHkiLCJyZWFzb24iLCJyZXF1ZXN0Q2xpZW50QXBwbGljYXRpb24iLCJyZXF1ZXN0TWV0aG9kIiwicmVxdWVzdFVybCIsInNldmVyaXR5Iiwic2V2ZXJpdHlfbGFiZWwiLCJzb3J0Iiwic291cmNlQWRkcmVzcyIsInNvdXJjZUhvc3ROYW1lIiwic291cmNlTnREb21haW4iLCJzb3VyY2VQcm9jZXNzTmFtZSIsInNvdXJjZVNlcnZpY2VOYW1lIiwic291cmNlVXNlcklkIiwic291cmNlVXNlck5hbWUiLCJzb3VyY2Vab25lVVJJIiwic3RhcnRUaW1lIiwidGFncyIsInR5cGUiCjIwMjEtMDgtMjggMTQ6MTE6MzksLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsCjoKCmNhdCA8PFw6ID51bHRpbWF0ZS5jc3YKIkB0aW1lc3RhbXAiLCJAdmVyc2lvbiIsIl9pZCIsIl9pbmRleCIsIl90eXBlIiwiYWQuRXZlbnRSZWNvcmRJRCIsImFkLkluaXRpYXRvcklEIiwiYWQuSW5pdGlhdG9yVHlwZSIsImFkLk9wY29kZSIsImFkLlByb2Nlc3NJRCIsImFkLlRhcmdldFNpZCIsImFkLlRocmVhZElEIiwiYWQuVmVyc2lvbiIsImFkLmFnZW50Wm9uZU5hbWUiLCJhZC5hbmFseXplZEJ5IiwiYWQuY29tbWFuZCIsImFkLmNvbXBsZXRlZCIsImFkLmN1c3RvbWVyTmFtZSIsImFkLmRhdGFiYXNlVGFibGUiLCJhZC5kZXNjcmlwdGlvbiIsImFkLmRlc3RpbmF0aW9uSG9zdHMiLCJhZC5kZXN0aW5hdGlvblpvbmVOYW1lIiwiYWQuZGV2aWNlWm9uZU5hbWUiLCJhZC5leHBpcmVkIiwiYWQuZmFpbGVkIiwiYWQubG9naW5OYW1lIiwiYWQubWF4TWF0Y2hlcyIsImFkLnBvbGljeU9iamVjdCIsImFkLnByb2R1Y3RWZXJzaW9uIiwiYWQucmVxdWVzdFVybEZpbGVOYW1lIiwiYWQuc2V2ZXJpdHlUeXBlIiwiYWQuc291cmNlSG9zdCIsImFkLnNvdXJjZUlwIiwiYWQuc291cmNlWm9uZU5hbWUiLCJhZC5zeXN0ZW1EZWxldGVkIiwiYWQudGltZVN0YW1wIiwiYWdlbnRBZGRyZXNzIiwiYWdlbnRIb3N0TmFtZSIsImFnZW50SWQiLCJhZ2VudE1hY0FkZHJlc3MiLCJhZ2VudFJlY2VpcHRUaW1lIiwiYWdlbnRUaW1lWm9uZSIsImFnZW50VHlwZSIsImFnZW50VmVyc2lvbiIsImFnZW50Wm9uZVVSSSIsImFwcGxpY2F0aW9uUHJvdG9jb2wiLCJiYXNlRXZlbnRDb3VudCIsImJ5dGVzSW4iLCJieXRlc091dCIsImNhdGVnb3J5QmVoYXZpb3IiLCJjYXRlZ29yeURldmljZUdyb3VwIiwiY2F0ZWdvcnlEZXZpY2VUeXBlIiwiY2F0ZWdvcnlPYmplY3QiLCJjYXRlZ29yeU91dGNvbWUiLCJjYXRlZ29yeVNpZ25pZmljYW5jZSIsImNlZlZlcnNpb24iLCJjdXN0b21lclVSSSIsImRlc3RpbmF0aW9uQWRkcmVzcyIsImRlc3RpbmF0aW9uRG5zRG9tYWluIiwiZGVzdGluYXRpb25Ib3N0TmFtZSIsImRlc3RpbmF0aW9uTnREb21haW4iLCJkZXN0aW5hdGlvblByb2Nlc3NOYW1lIiwiZGVzdGluYXRpb25TZXJ2aWNlTmFtZSIsImRlc3RpbmF0aW9uVGltZVpvbmUiLCJkZXN0aW5hdGlvblVzZXJJZCIsImRlc3RpbmF0aW9uVXNlck5hbWUiLCJkZXN0aW5hdGlvblpvbmVVUkkiLCJkZXZpY2VBY3Rpb24iLCJkZXZpY2VBZGRyZXNzIiwiZGV2aWNlQ3VzdG9tRGF0ZTEiLCJkZXZpY2VDdXN0b21EYXRlMUxhYmVsIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzIiwiZGV2aWNlQ3VzdG9tSVB2NkFkZHJlc3MzTGFiZWwiLCJkZXZpY2VDdXN0b21OdW1iZXIxIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMUxhYmVsIiwiZGV2aWNlQ3VzdG9tTnVtYmVyMiIsImRldmljZUN1c3RvbU51bWJlcjJMYWJlbCIsImRldmljZUN1c3RvbU51bWJlcjMiLCJkZXZpY2VDdXN0b21OdW1iZXIzTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmcxIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMUxhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nMiIsImRldmljZUN1c3RvbVN0cmluZzJMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzMiLCJkZXZpY2VDdXN0b21TdHJpbmczTGFiZWwiLCJkZXZpY2VDdXN0b21TdHJpbmc0IiwiZGV2aWNlQ3VzdG9tU3RyaW5nNExhYmVsIiwiZGV2aWNlQ3VzdG9tU3RyaW5nNSIsImRldmljZUN1c3RvbVN0cmluZzVMYWJlbCIsImRldmljZUN1c3RvbVN0cmluZzYiLCJkZXZpY2VDdXN0b21TdHJpbmc2TGFiZWwiLCJkZXZpY2VFdmVudENhdGVnb3J5IiwiZGV2aWNlRXZlbnRDbGFzc0lkIiwiZGV2aWNlSG9zdE5hbWUiLCJkZXZpY2VOdERvbWFpbiIsImRldmljZVByb2Nlc3NOYW1lIiwiZGV2aWNlUHJvZHVjdCIsImRldmljZVJlY2VpcHRUaW1lIiwiZGV2aWNlU2V2ZXJpdHkiLCJkZXZpY2VWZW5kb3IiLCJkZXZpY2VWZXJzaW9uIiwiZGV2aWNlWm9uZVVSSSIsImVuZFRpbWUiLCJldmVudElkIiwiZXZlbnRPdXRjb21lIiwiZXh0ZXJuYWxJZCIsImZhY2lsaXR5IiwiZmFjaWxpdHlfbGFiZWwiLCJmaWxlTmFtZSIsImZpbGVUeXBlIiwiZmxleFN0cmluZzFMYWJlbCIsImZsZXhTdHJpbmcyIiwiZ2VpZCIsImhpZ2hsaWdodCIsImhvc3QiLCJtZXNzYWdlIiwibmFtZSIsIm9sZEZpbGVIYXNoIiwicHJpb3JpdHkiLCJyZWFzb24iLCJyZXF1ZXN0Q2xpZW50QXBwbGljYXRpb24iLCJyZXF1ZXN0TWV0aG9kIiwicmVxdWVzdFVybCIsInNldmVyaXR5Iiwic2V2ZXJpdHlfbGFiZWwiLCJzb3J0Iiwic291cmNlQWRkcmVzcyIsInNvdXJjZUhvc3ROYW1lIiwic291cmNlTnREb21haW4iLCJzb3VyY2VQcm9jZXNzTmFtZSIsInNvdXJjZVNlcnZpY2VOYW1lIiwic291cmNlVXNlcklkIiwic291cmNlVXNlck5hbWUiLCJzb3VyY2Vab25lVVJJIiwic3RhcnRUaW1lIiwidGFncyIsInR5cGUiCjIwMjEtMDgtMjggMTQ6MTE6MzksLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsCjoKCmNhdCA8PFw6ID5tZXJnZS5weQppbXBvcnQgY3N2CmltcG9ydCBzeXMKCmZpZWxkcyA9IDAKZm9yIGZpbGVuYW1lIGluIHN5cy5hcmd2WzE6XToKICAgIHdpdGggb3BlbihmaWxlbmFtZSkgYXMgcmF3OgogICAgICAgIGZvciByb3cgaW4gY3N2LnJlYWRlcihyYXcpOgogICAgICAgICAgICBpZiBsZW4ocm93KSA+IGZpZWxkczoKICAgICAgICAgICAgICAgIGZpZWxkcyA9IGxlbihyb3cpCiAgICAgICAgICAgICAgICB0aXRsZXMgPSByb3cKICAgICAgICAgICAgYnJlYWsKCndyaXRlciA9IGNzdi53cml0ZXIoc3lzLnN0ZG91dCkKd3JpdGVyLndyaXRlcm93KHRpdGxlcykKCmZvciBmaWxlbmFtZSBpbiBzeXMuYXJndlsxOl06CiAgICB3aXRoIG9wZW4oZmlsZW5hbWUpIGFzIHJhdzoKICAgICAgICBmb3IgaWR4LCByb3cgaW4gZW51bWVyYXRlKGNzdi5yZWFkZXIocmF3KSk6CiAgICAgICAgICAgIGlmIGlkeCA9PSAwOgogICAgICAgICAgICAgICAgbmV4dAogICAgICAgIHJvdy5leHRlbmQoWycnXSAqIChmaWVsZHMgLSBsZW4ocm93KSkpCiAgICAgICAgd3JpdGVyLndyaXRlcm93KHJvdykKOgoKYXdrIC1GICcsJyAnRk5SID09IDEgeyBwcmludCBORiwgRklMRU5BTUU7IG4gPSBORiB9Ck5GICE9IG4geyBwcmludCBGSUxFTkFNRSAiOiIgRk5SICI6IHdyb25nIG51bWJlciBvZiBmaWVsZHMgIiBORiAiIChleHBlY3RlZCAiIG4gIikiIH0nICouY3N2CgpweXRob24zIG1lcmdlLnB5ICouY3N2Cg==
141 first.csv
first.csv:2: wrong number of fields 140 (expected 141)
137 second.csv
second.csv:2: wrong number of fields 140 (expected 137)
137 third.csv
third.csv:2: wrong number of fields 140 (expected 137)
137 ultimate.csv
ultimate.csv:2: wrong number of fields 140 (expected 137)
@timestamp,@version,_id,_index,_type,ad.(fydibohf23spdlt)/cn,ad.</o,ad.EventRecordID,ad.InitiatorID,ad.InitiatorType,ad.Opcode,ad.ProcessID,ad.TargetSid,ad.ThreadID,ad.Version,ad.agentZoneName,ad.analyzedBy,ad.command,ad.completed,ad.customerName,ad.databaseTable,ad.description,ad.destinationHosts,ad.destinationZoneName,ad.deviceZoneName,ad.expired,ad.failed,ad.loginName,ad.maxMatches,ad.policyObject,ad.productVersion,ad.requestUrlFileName,ad.severityType,ad.sourceHost,ad.sourceIp,ad.sourceZoneName,ad.systemDeleted,ad.timeStamp,ad.totalComputers,agentAddress,agentHostName,agentId,agentMacAddress,agentReceiptTime,agentTimeZone,agentType,agentVersion,agentZoneURI,applicationProtocol,baseEventCount,bytesIn,bytesOut,categoryBehavior,categoryDeviceGroup,categoryDeviceType,categoryObject,categoryOutcome,categorySignificance,cefVersion,customerURI,destinationAddress,destinationDnsDomain,destinationHostName,destinationNtDomain,destinationProcessName,destinationServiceName,destinationTimeZone,destinationUserId,destinationUserName,destinationUserPrivileges,destinationZoneURI,deviceAction,deviceAddress,deviceCustomDate1,deviceCustomDate1Label,deviceCustomIPv6Address3,deviceCustomIPv6Address3Label,deviceCustomNumber1,deviceCustomNumber1Label,deviceCustomNumber2,deviceCustomNumber2Label,deviceCustomNumber3,deviceCustomNumber3Label,deviceCustomString1,deviceCustomString1Label,deviceCustomString2,deviceCustomString2Label,deviceCustomString3,deviceCustomString3Label,deviceCustomString4,deviceCustomString4Label,deviceCustomString5,deviceCustomString5Label,deviceCustomString6,deviceCustomString6Label,deviceEventCategory,deviceEventClassId,deviceHostName,deviceNtDomain,deviceProcessName,deviceProduct,deviceReceiptTime,deviceSeverity,deviceVendor,deviceVersion,deviceZoneURI,endTime,eventId,eventOutcome,externalId,facility,facility_label,fileName,fileType,flexString1Label,flexString2,geid,highlight,host,message,name,oldFileHash,priority,reason,requestClientApplication,requestMethod,requestUrl,severity,severity_label,sort,sourceAddress,sourceHostName,sourceNtDomain,sourceProcessName,sourceServiceName,sourceUserId,sourceUserName,sourceZoneURI,startTime,tags,type
2021-07-27 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2021-07-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2021-08-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2021-08-28 14:11:39,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,