Group: Forum Members
I'm trying to set up a parser for the Sonicwall firewall.
I stop at moment on message.
I have two similar messages:
msg="Connection Closed" app=7927 n=12234655
msg="Connection Opened" app=49177 appName="General HTTPS" n=5319205
as you see on one is "appName". I worry that If this is missing in line, the parser will give me en error. Or not?
At moment whole message is in one column but I want to split it into different columns.