Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who Me Too'd this topic

Cut syslog messages, strugeling on commas between quotes

L3 Networker



Demisto get a syslog message from panorama from threat log.

To clarify my problem, here a simplified syslog output, which Demisto gets in:

1,2,3,"jon,doe",5,6,7 (Example: Mail Subject)


My Problem lies on the syslog incoming Mapper, I would like to cut the syslog message into the right field, (here "Subject")

So, I use as first transformer "Replace match (String)" to get rid of the commas between the "

the only one reasonable regex string I found so far is that one:


But since Demisto uses for "Replace match (String)" those Regex-Implementation ( the ?= regex is not working (NOT IMPLEMENTED)


Is any one here with a solution regarding those "commas between double quotes"? Maybe there is a way on Panorama to escape those commas with ie "=2C"?

Any help will be apriciated





Who Me Too'd this topic