[METRON-941] native PaloAlto parser corrupts message when having a comma in the payload

• Type: Bug
• Status: Done
• Priority: Minor
• Resolution: Done
• Affects Version/s: 0.4.0
• Fix Version/s: 0.5.0
• Environment: full-dev master
• Assignee: Unassigned
• Reporter: Christian Tramnitz
• Created: 09/May/17 11:54
• Updated: 22/May/18 19:34
• Resolved: 22/May/18 19:30

Description

When a data field contains a comma (i.e. the URL, not too uncommon), the split(",") kicks in and the rest of the message if off by few fields due to positional definition.

Issue Links

• links to: GitHub Pull Request #579
• links to: GitHub Pull Request #579