Missing multi-category URL Filtering field extraction

[linsmeyerh]

Noted on Palo Alto Add-on for Splunk the field extraction for log type pan:threat logs stops at field content_version section (comma "," separated section) not capturing the 5th section "ahead" available in the firewall raw logs, which is the proposed new field category.

The field category is currently evaluated from raw_category or threat_category fields not providing the full multi category URL filtering visibility as available in the firewall raw logs.

[simonsigre]

Nice work @linsmeyerh, great fix

[kylegbakker]

This will save a lot of headache. Thanks @linsmeyerh !

[davidclarke-au]

Thanks @linsmeyerh , nice find!

[Git-Portal]

Great work, Thanks @linsmeyerh

[jxztan]

Great job @linsmeyerh !

[amanuelw]

awesome work @linsmeyerh

[grantrburgess]

Thanks @linsmeyerh this will really help us!