using the opsec lea app and noticed that two of the default kv extract key/value pairs werent working for me. The log entry for the relevant key/value was i/f_dir and i/f_name not i_f_dir and i_f_name. I tried to escape the / in the key but that failed as the extracted format was f_name and f_dir.
How do you escape the / in the key?
Here is the attempted setting in props.conf I know its failing as the key displayed in the seach window is not direction and inbound_interface instead its f_name and f_dir.
#had to modify from i_f_dir
#had to modify from i_f_name