I removed the last capture group from the scan_verdict_info_extract in transforms.conf in order to get that extraction to work properly (and the related automatic lookups to work), leaving the new(?) fields unaccounted for.
It looks like the x-result-code for WSA 10.x has three additional fields and the capture group at the end of the giant regex (?:>|>) breaks the entire extraction.
<IW_infr,3.9,0,"-",0,0,0,1,"-",-,-,-,"-",1,-,"-","-",-,-,IW_infr,-,"Unknown","-","Unknown","Unknown","-","-",288.91,0,Local,"Unknown","-",-,"-",-,-,"-","-",-,-,"-">
Our Ironports are currently running on 10.1.0-204 for Web
... View more