earliest="06/06/2023:19:10:00" latest="06/06/2023:19:20:00" index=f5 AND sourcetype=f5_asm  AND support_id=9216504019076316805 | rex field=_raw  "User-Agent: (?<user_agent>.*?)\\\r\\\n" | rex field=_raw  "Host: (?<host_hdr>.*?)\\\r\\\n" | rex field=_raw  "Referer: (?<referer>.*?)\\\r\\\n" | rex field=violation_details mode=sed "s#<metachar_index>0</metachar_index>#<metachar_index>NUL 0 %0 0x0,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>1</metachar_index>#<metachar_index>SOH 1 %1 0x1,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>2</metachar_index>#<metachar_index>STX 2 %2 0x2,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>3</metachar_index>#<metachar_index>ETX 3 %3 0x3,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>4</metachar_index>#<metachar_index>EOT 4 %4 0x4,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>5</metachar_index>#<metachar_index>ENQ 5 %5 0x5,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>6</metachar_index>#<metachar_index>ACK 6 %6 0x6,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>7</metachar_index>#<metachar_index>BEL 7 %7 0x7,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>8</metachar_index>#<metachar_index>BS 8 %8 0x8,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>9</metachar_index>#<metachar_index>HT 9 %9 0x9,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>10</metachar_index>#<metachar_index>LF 10 %0A 0x0a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>11</metachar_index>#<metachar_index>VT 11 %0B 0x0b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>12</metachar_index>#<metachar_index>FF 12 %0C 0x0c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>13</metachar_index>#<metachar_index>CR 13 %0D 0x0d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>14</metachar_index>#<metachar_index>SO 14 %0E 0x0e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>15</metachar_index>#<metachar_index>SI 15 %0F 0x0f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>16</metachar_index>#<metachar_index>DLE 16 %10 0x10,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>17</metachar_index>#<metachar_index>DC1 17 %11 0x11,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>18</metachar_index>#<metachar_index>DC2 18 %12 0x12,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>19</metachar_index>#<metachar_index>DC3 19 %13 0x13,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>20</metachar_index>#<metachar_index>DC4 20 %14 0x14,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>21</metachar_index>#<metachar_index>NAK 21 %15 0x15,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>22</metachar_index>#<metachar_index>SYN 22 %16 0x16,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>23</metachar_index>#<metachar_index>ETB 23 %17 0x17,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>24</metachar_index>#<metachar_index>CAN 24 %18 0x18,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>25</metachar_index>#<metachar_index>EM 25 %19 0x19,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>26</metachar_index>#<metachar_index>SUB 26 %1A 0x1a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>27</metachar_index>#<metachar_index>ESC 27 %1B 0x1b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>28</metachar_index>#<metachar_index>FS 28 %1C 0x1c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>29</metachar_index>#<metachar_index>GS 29 %1D 0x1d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>30</metachar_index>#<metachar_index>RS 30 %1E 0x1e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>31</metachar_index>#<metachar_index>US 31 %1F 0x1f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>32</metachar_index>#<metachar_index>SPACE 32 %20 0x20,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>33</metachar_index>#<metachar_index>! 33 %21 0x21,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>34</metachar_index>#<metachar_index>\" 34 %22 0x22,</metachar_index>#g" | rex field=violation_details mode=sed "s@<metachar_index>35</metachar_index>@<metachar_index># 35 %23 0x23,</metachar_index>@g" | rex field=violation_details mode=sed "s#<metachar_index>36</metachar_index>#<metachar_index>$ 36 %24 0x24,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>37</metachar_index>#<metachar_index>% 37 %25 0x25,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>38</metachar_index>#<metachar_index>\& 38 %26 0x26,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>39</metachar_index>#<metachar_index>' 39 %27 0x27,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>40</metachar_index>#<metachar_index>( 40 %28 0x28,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>41</metachar_index>#<metachar_index>) 41 %29 0x29,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>42</metachar_index>#<metachar_index>* 42 %2A 0x2a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>43</metachar_index>#<metachar_index>+ 43 %2B 0x2b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>44</metachar_index>#<metachar_index>, 44 %2C 0x2c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>45</metachar_index>#<metachar_index>- 45 %2D 0x2d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>46</metachar_index>#<metachar_index>. 46 %2E 0x2e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>47</metachar_index>#<metachar_index>/ 47 %2F 0x2f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>48</metachar_index>#<metachar_index>0 48 %30 0x30,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>49</metachar_index>#<metachar_index>1 49 %31 0x31,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>50</metachar_index>#<metachar_index>2 50 %32 0x32,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>51</metachar_index>#<metachar_index>3 51 %33 0x33,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>52</metachar_index>#<metachar_index>4 52 %34 0x34,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>53</metachar_index>#<metachar_index>5 53 %35 0x35,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>54</metachar_index>#<metachar_index>6 54 %36 0x36,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>55</metachar_index>#<metachar_index>7 55 %37 0x37,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>56</metachar_index>#<metachar_index>8 56 %38 0x38,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>57</metachar_index>#<metachar_index>9 57 %39 0x39,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>58</metachar_index>#<metachar_index>: 58 %3A 0x3a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>59</metachar_index>#<metachar_index>; 59 %3B 0x3b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>60</metachar_index>#<metachar_index>< 60 %3C 0x3c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>61</metachar_index>#<metachar_index>= 61 %3D 0x3d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>62</metachar_index>#<metachar_index>> 62 %3E 0x3e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>63</metachar_index>#<metachar_index>? 63 %3F 0x3f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>64</metachar_index>#<metachar_index>@ 64 %40 0x40,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>65</metachar_index>#<metachar_index>A 65 %41 0x41,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>66</metachar_index>#<metachar_index>B 66 %42 0x42,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>67</metachar_index>#<metachar_index>C 67 %43 0x43,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>68</metachar_index>#<metachar_index>D 68 %44 0x44,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>69</metachar_index>#<metachar_index>E 69 %45 0x45,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>70</metachar_index>#<metachar_index>F 70 %46 0x46,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>71</metachar_index>#<metachar_index>G 71 %47 0x47,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>72</metachar_index>#<metachar_index>H 72 %48 0x48,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>73</metachar_index>#<metachar_index>I 73 %49 0x49,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>74</metachar_index>#<metachar_index>J 74 %4A 0x4a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>75</metachar_index>#<metachar_index>K 75 %4B 0x4b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>76</metachar_index>#<metachar_index>L 76 %4C 0x4c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>77</metachar_index>#<metachar_index>M 77 %4D 0x4d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>78</metachar_index>#<metachar_index>N 78 %4E 0x4e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>79</metachar_index>#<metachar_index>O 79 %4F 0x4f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>80</metachar_index>#<metachar_index>P 80 %50 0x50,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>81</metachar_index>#<metachar_index>Q 81 %51 0x51,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>82</metachar_index>#<metachar_index>R 82 %52 0x52,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>83</metachar_index>#<metachar_index>S 83 %53 0x53,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>84</metachar_index>#<metachar_index>T 84 %54 0x54,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>85</metachar_index>#<metachar_index>U 85 %55 0x55,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>86</metachar_index>#<metachar_index>V 86 %56 0x56,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>87</metachar_index>#<metachar_index>W 87 %57 0x57,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>88</metachar_index>#<metachar_index>X 88 %58 0x58,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>89</metachar_index>#<metachar_index>Y 89 %59 0x59,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>90</metachar_index>#<metachar_index>Z 90 %5A 0x5a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>91</metachar_index>#<metachar_index>[ 91 %5B 0x5b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>92</metachar_index>#<metachar_index>\\\ 92 %5C 0x5c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>93</metachar_index>#<metachar_index>] 93 %5D 0x5d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>94</metachar_index>#<metachar_index>^94 %5E 0x5e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>95</metachar_index>#<metachar_index>_ 95 %5F 0x5f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>96</metachar_index>#<metachar_index>` 96 %60 0x60,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>97</metachar_index>#<metachar_index>a 97 %61 0x61,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>98</metachar_index>#<metachar_index>b 98 %62 0x62,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>99</metachar_index>#<metachar_index>c 99 %63 0x63,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>100</metachar_index>#<metachar_index>d 100 %64 0x64,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>101</metachar_index>#<metachar_index>e 101 %65 0x65,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>102</metachar_index>#<metachar_index>f 102 %66 0x66,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>103</metachar_index>#<metachar_index>g 103 %67 0x67,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>104</metachar_index>#<metachar_index>h 104 %68 0x68,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>105</metachar_index>#<metachar_index>i 105 %69 0x69,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>106</metachar_index>#<metachar_index>j 106 %6A 0x6a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>107</metachar_index>#<metachar_index>k 107 %6B 0x6b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>108</metachar_index>#<metachar_index>l 108 %6C 0x6c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>109</metachar_index>#<metachar_index>m 109 %6D 0x6d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>110</metachar_index>#<metachar_index>n 110 %6E 0x6e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>111</metachar_index>#<metachar_index>o 111 %6F 0x6f,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>112</metachar_index>#<metachar_index>p 112 %70 0x70,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>113</metachar_index>#<metachar_index>q 113 %71 0x71,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>114</metachar_index>#<metachar_index>r 114 %72 0x72,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>115</metachar_index>#<metachar_index>s 115 %73 0x73,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>116</metachar_index>#<metachar_index>t 116 %74 0x74,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>117</metachar_index>#<metachar_index>u 117 %75 0x75,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>118</metachar_index>#<metachar_index>v 118 %76 0x76,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>119</metachar_index>#<metachar_index>w 119 %77 0x77,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>120</metachar_index>#<metachar_index>x 120 %78 0x78,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>121</metachar_index>#<metachar_index>y 121 %79 0x79,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>122</metachar_index>#<metachar_index>z 122 %7A 0x7a,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>123</metachar_index>#<metachar_index>{ 123 %7B 0x7b,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>124</metachar_index>#<metachar_index>| 124 %7C 0x7c,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>125</metachar_index>#<metachar_index>} 125 %7D 0x7d,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>126</metachar_index>#<metachar_index>~ 126 %7E 0x7e,</metachar_index>#g" | rex field=violation_details mode=sed "s#<metachar_index>127</metachar_index>#<metachar_index>DELETE 127 %7F 0x7f,</metachar_index>#g" | replace "/Common/*" with * in policy_name | rex max_match=10 field=violation_details "<buffer>(?<buffer>[^<]+)</buffer>" | eval buffer=mvdedup(buffer) |   rex max_match=10 field=violation_details "<cookie_name>(?<cookie_name>[^<]+)</cookie_name>" |   rex max_match=10 field=violation_details "<cookie_value>(?<cookie_value>[^<]+)</cookie_value>" |  rex max_match=10 field=violation_details "<extension>(?<extension>[^<]+)</extension>" |   rex max_match=10 field=violation_details "<name>(?<name>[^<]+)</name>"  |  rex max_match=10 field=violation_details "<value>(?<value>[^<]+)</value>"  |  rex max_match=10 field=violation_details "<header_name>(?<header>[^<]+)</header_name>" |   rex max_match=10 field=violation_details "<header_value>(?<header_value>[^<]+)</header_value>" |   rex max_match=10 field=violation_details "<object>(?<object>(.*?))</object>"  |rex max_match=10 field=violation_details "<param_name>(?<param_name>[^<]+)</param_name>" | rex max_match=10 field=violation_details "<param_value>(?<param_value>[^<]+)</param_value>" |rex max_match=10 field=violation_details "<object>(?<object>[^<]+)</object>" |   rex max_match=10 field=violation_details "<http_sub_violation>(?<http_sub_violation>[^<]+)</http_sub_violation>" |  rex max_match=10 field=violation_details "total_len>(?<req_len>[^<]+)" | rex max_match=10 field=violation_details "total_len_limit>(?<req_limit>[^<]+)" | rex max_match=10 field=violation_details "post_len>(?<post_len>[^<]+)" | rex max_match=10 field=violation_details "post_len_limit>(?<post_limit>[^<]+)" | rex max_match=10 field=violation_details "qs_len>(?<qs_len>[^<]+)" | rex max_match=10 field=violation_details "qs_len_limit>(?<qs_limit>[^<]+)" | rex max_match=10 field=violation_details "uri_len>(?<uri_len>[^<]+)" | rex max_match=10 field=violation_details "uri_len_limit>(?<uri_limit>[^<]+)" | rex max_match=10 field=violation_details "actual_value_length>(?<val_len>[^<]+)" | rex max_match=10 field=violation_details "expected_value_length>(?<val_limit>[^<]+)" | rex max_match=1000 field=violation_details "<metachar_index>(?P<metachar>(.*?))</metachar_index>" | rex max_match=1000 field=violation_details "<enforcement_level>(?P<enforced>(.*?))</enforcement_level>" | rex max_match=1000 field=violation_details "<sig_id>(?P<vd_sigs>(.*?))</sig_id>" | rex max_match=1000 field=violation_details "<wildcard_entity>(?P<wildmatch>(.*?))</wildcard_entity>" | rex max_match=1000 field=violation_details "<viol_name>(?P<viol_name>(.*?))</viol_name>" | rex max_match=1000 field=violation_details "<staging>(?P<staging>(.*?))</staging>" | rex max_match=1000 field=violation_details "<blocking_mask>(?P<blk_mask>(.*?))</blocking_mask>" | eval viol_name=mvdedup(viol_name) | eval staging=mvdedup(staging) | eval vd_sigs=mvdedup(vd_sigs) | eval metachar=mvdedup(metachar) | eval blk_mask=mvdedup(blk_mask) | eval cookie_name=mvdedup(cookie_name) | eval cookie_value=mvdedup(cookie_value) | eval extension=mvdedup(extension) | eval name=mvdedup(name) | eval param_name=mvdedup(param_name) | eval object=mvdedup(object) | eval value=mvdedup(value) | eval header=mvdedup(header) | eval header_value=mvdedup(header_value) | eval param_value=mvdedup(param_value) | eval extension=mvdedup(extension) | eval wildmatch=mvdedup(wildmatch) | eval enforced=mvdedup(enforced) | replace "4" with "Staging/Passed", "6" with "Monitor/Alerted", "7" with "Deny/Blocked" in blk_mask | code field=http_sub_violation method=base64 action=decode destfield=http_sub_violation_dec | code field=buffer method=base64 action=decode destfield=buffer_dec | code field=cookie_name method=base64 action=decode destfield=cookie_name_dec | code field=cookie_value method=base64 action=decode destfield=cookie_value_dec | code field=extension method=base64 action=decode destfield=extension_dec | code field=name method=base64 action=decode destfield=name_dec | code field=param_name method=base64 action=decode destfield=param_name_dec | code field=object method=base64 action=decode destfield=object_dec | code field=value method=base64 action=decode destfield=value_dec | code field=header method=base64 action=decode destfield=header_dec | code field=header_value method=base64 action=decode destfield=header_value_dec | code field=param_value method=base64 action=decode destfield=param_value_dec | table src_ip,_time,unit_hostname,user_agent,referer,host_hdr,uri,uri_query,method,resp_code,severity,action,viol_name,violations,sub_violations,attack_type,blk_mask,staging,policy_name,vd_sigs,sig_names,staged_sig_ids,staged_sig_names,wildmatch,enforced,metachar,buffer,buffer_dec,cookie_name,cookie_name_dec,cookie_value,cookie_value_dec,extension,extension_dec,name,name_dec,param_name,param_name_dec,object,object_dec,value,value_dec,header,header_dec,header_value,header_value_dec,param_value,param_value_dec,req_len,req_limit,post_len,post_limit,qs_len,qs_limit,uri_len,uri_limit,val_len,val_limit,http_sub_violation,http_sub_violation_dec,violation_details,request,response,support_id | sort _time