I'm exporting the URL log to CSV file (I'm using CLI csp export), but I'm having a issue when I try to import this log in MS Excel because some URL have a comma, that break the columns in a wrong way.
Anybody knows if is there a way to export the URL field between double quote?
I'm think that user_agent field can do the same issue.
I confirm the same behaviour in version 7.0.6
Export log from the CLI text fields are enclosed in quotation marks and we don't have the limit of 65535 line.
Export log from WebGUI text fields not have any delimiter.
scp export log url source-ip 192.168.1.1 start-time equal 2017/01/04@09:00:00 end-time equal 2017/01/04@11:00:00 to email@example.com:/tmp/filone9-11.csv
Why Palo Alto not correct this crazy bug !?!?!?
I don't really export URL logs so I can't say for certain if the issue has been fixed; but bugs are fixed by priority so if it's something you want fixed talk to your SE and get your vote added to the feature request. That being said they maybe have fixed this; you are running a version that would have been current when this was fielded, potentially you just need to update to the latest 7.0.12 or 7.1.7.
It's more of how they are exporting the url field. If you export into a CSV then something that could potentially include a "," would need to have something like a ',' around the value to dictate that the comma is not a start of a new value. If it was made so that the whole URL was contained and announced as one value then the issue wouldn't appear.
That being said what URLs are you visiting that actually have a comma in the field; I don't think I can think of a valid address that has one, however this may be something more prevelent outside of the US maybe?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!