How to exporting URL log to CSV with comma inside URL field?

[Lauro]

Hello,

I'm exporting the URL log to CSV file (I'm using CLI csp export), but I'm having a issue when I try to import this log in MS Excel because some URL have a comma, that break the columns in a wrong way.

Anybody knows if is there a way to export the URL field between double quote?

I'm think that user_agent field can do the same issue.

[Lauro]

Hello again, 

I was mistake. The problem comes when the CSV is exported from the web interface. In the CLI interface URL field is in quotes.

[Passepartout]

I confirm the same behaviour in version 7.0.6

Export log from the CLI text fields are enclosed in quotation marks and we don't have the limit of 65535 line.

Export log from WebGUI text fields not have any delimiter.

example:

scp export log url source-ip 192.168.1.1 start-time equal 2017/01/04@09:00:00 end-time equal 2017/01/04@11:00:00 to root@192.168.1.10:/tmp/filone9-11.csv

Why Palo Alto not correct this crazy bug !?!?!?

[BPry]

I don't really export URL logs so I can't say for certain if the issue has been fixed; but bugs are fixed by priority so if it's something you want fixed talk to your SE and get your vote added to the feature request. That being said they maybe have fixed this; you are running a version that would have been current when this was fielded, potentially you just need to update to the latest 7.0.12 or 7.1.7. 

[OtakarKlier]

I just checked mine and it also has the same issue where after the comma it is split into another column. I would say this is a bug and like BPry suggested, contact your SE or open a ticket.

[OtakarKlier]

So thinking about this a bit more, it could be an Excel issue and not Palo Alto as the CSV is a comma seperated value?

[BPry]

It's more of how they are exporting the url field. If you export into a CSV then something that could potentially include a "," would need to have something like a ',' around the value to dictate that the comma is not a start of a new value. If it was made so that the whole URL was contained and announced as one value then the issue wouldn't appear. 

That being said what URLs are you visiting that actually have a comma in the field; I don't think I can think of a valid address that has one, however this may be something more prevelent outside of the US maybe? 

[Lauro]

These are some exemples:

http://images.taboola.com/taboola/image/fetch/f_jpg,q_auto,h_220,w_440,c_fill,g_faces:auto,e_sharpen...

www.saraiva.com.br/saraivaintegracao/views/saraivaintegracao.aspx?Tipo=CONSULTAPARCELAMENTOVITRINESI...

[Lauro]

I don't believe it's a Excel issue.
The field must be into quotation mark, without this the clients can't understand where that field end.
CLI's export logs is into quotation mark.