The extract command is made for that kind of parsing, but it will be tripped up by the extra ":" separators in the timestamp. Regex will do the job, however, but there's no special command for it. Assuming the fields are always in the same order then this will do it. | rex "firepower : (?<firepower>[^:]+): EventPriority: (?<EventPriority>\w+), DeviceUUID: (?<DeviceUUID>[^,]+), InstanceID: (?<InstanceID>[^,]+), FirstPacketSecond: (?<FirstPacketSecond>[^,]+), ConnectionID: (?<ConnectionID>[^,]+), AccessControlRuleAction: (?<AccessControlRuleAction>[^,]+), SrcIP: (?<SrcIP>[^,]+), DstIP: (?<DstIP>[^,]+), SrcPort: (?<SrcPort>\d+), DstPort: (?<DstPort>\d+), Protocol: \w+" If the fields might appear in any order then a separate rex command is needed for each one.
... View more
