How to exporting URL log to CSV with comma inside URL field?

cancel
Showing results for 
Search instead for 
Did you mean: 

How to exporting URL log to CSV with comma inside URL field?

L1 Bithead

Hello,

 

I'm exporting the URL log to CSV file (I'm using CLI csp export), but I'm having a issue when I try to import this log in MS Excel because some URL have a comma, that break the columns in a wrong way.


Anybody knows if is there a way to export the URL field between double quote?

 

I'm think that user_agent field can do the same issue.

8 REPLIES 8

L1 Bithead

Hello again, 

 

I was mistake. The problem comes when the CSV is exported from the web interface. In the CLI interface URL field is in quotes.

 

 

I confirm the same behaviour in version 7.0.6

Export log from the CLI text fields are enclosed in quotation marks and we don't have the limit of 65535 line.

Export log from WebGUI text fields not have any delimiter.

 

example:

scp export log url source-ip 192.168.1.1 start-time equal 2017/01/04@09:00:00 end-time equal 2017/01/04@11:00:00 to root@192.168.1.10:/tmp/filone9-11.csv

 

Why Palo Alto not correct this crazy bug !?!?!?

I don't really export URL logs so I can't say for certain if the issue has been fixed; but bugs are fixed by priority so if it's something you want fixed talk to your SE and get your vote added to the feature request. That being said they maybe have fixed this; you are running a version that would have been current when this was fielded, potentially you just need to update to the latest 7.0.12 or 7.1.7. 

I just checked mine and it also has the same issue where after the comma it is split into another column. I would say this is a bug and like BPry suggested, contact your SE or open a ticket.

So thinking about this a bit more, it could be an Excel issue and not Palo Alto as the CSV is a comma seperated value?

It's more of how they are exporting the url field. If you export into a CSV then something that could potentially include a "," would need to have something like a ',' around the value to dictate that the comma is not a start of a new value. If it was made so that the whole URL was contained and announced as one value then the issue wouldn't appear. 

That being said what URLs are you visiting that actually have a comma in the field; I don't think I can think of a valid address that has one, however this may be something more prevelent outside of the US maybe? 

I don't believe it's a Excel issue.
The field must be into quotation mark, without this the clients can't understand where that field end.
CLI's export logs is into quotation mark.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!