HI Experts.
I did fields extraction in regexr, The fields matching in regexr is no problem.
But, On splunk , we can see only EXTRACT-Security_Firewall-threat_00. This logs is paloalto logs.
EXTRACT-Security_Firewall-threat_01 cannot see on splunk fields. what is problem ?
EXTRACT-Security_Firewall-threat_00 = ^\w+\s+\d+\s+\d+:\d+:\d+\s+\d+.\d+.\d+.\d+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+(?<future_use1>[^,]+),+(?<receive_time>[^,]+),+(?<serial_number>[^,]+),+(?<type>[^,]+),+(?<log_subtype>[^,]+),+(?<future_use2>[^,]+),+(?<generated_time>[^,]+),+(?<src_ip>[^,]+),+(?<dst_ip>[^,]+),+(?<nat_src_ip>[^,]+),+(?<nat_dst_ip>[^,]+),+(?<rule_name>[^,]+),(?<src_user>\w*)\,(?<dst_user>\w*)\,+(?<application>[^,]+),+(?<virtual_system>[^,]+),+(?<src_zone>[^,]+),+(?<dst_zone>[^,]+),+(?<ingress_interface>[^,]+),+(?<egress_interface>[^,]+),+(?<log_forwarding_profile>[^,]+),+(?<future_use3>[^,]+),+(?<session_id>[^,]+),+(?<repeat_count>[^,]+),+(?<src_port>[^,]+),+(?<dst_port>[^,]+),+(?<nat_src_port>[^,]+),+(?<nat_dst_port>[^,]+),+(?<flags>[^,]+),+(?<protocol>[^,]+),+(?<action>[^,]+),"+(?<misc>[^,]+)\"
EXTRACT-Security_Firewall-threat_01 = \",(?<threat_id>[^,]+),+(?<category>[^,]+),+(?<severity>[^,]+),+(?<direction>[^,]+),+(?<sequence_number>[^,]+),+(?<action_flags>[^,]+),+(?<src_location>[^,]+),+(?<dst_location>[^,]+),+(?<future_use4>[^,]+),+(?<content_type>[^ ].*)
... View more