* | where content like '%RG-WALL%'
| parse-regexp content, 'devname="([^"]+)"' as devname
| parse-regexp content, 'devid="([^"]+)"' as devid
| parse-regexp content, 'logid="([^"]+)"' as logid
| parse-regexp content, 'type="([^"]+)"' as type
| parse-regexp content, 'subtype="([^"]+)"' as subtype
| parse-regexp content, 'level="([^"]+)"' as level
| parse-regexp content, 'vd="([^"]+)"' as vd
| parse-regexp content, 'eventtime=([^\s"]+)' as eventtime
| parse-regexp content, 'srcip=([^\s"]+)' as srcip
| parse-regexp content, 'srcport=([^\s"]+)' as srcport
| parse-regexp content, 'srcintf="([^"]+)"' as srcintf
| parse-regexp content, 'srcintfrole="([^"]+)"' as srcintfrole
| parse-regexp content, 'dstip=([^\s"]+)' as dstip
| parse-regexp content, 'dstport=([^\s"]+)' as dstport
| parse-regexp content, 'dstintf="([^"]+)"' as dstintf
| parse-regexp content, 'dstintfrole="([^"]+)"' as dstintfrole
| parse-regexp content, 'sessionid=([^\s"]+)' as sessionid
| parse-regexp content, 'proto=([^\s"]+)' as proto
| parse-regexp content, 'action="([^"]+)"' as action
| parse-regexp content, 'policyid=([^\s"]+)' as policyid
| parse-regexp content, 'poluuid="([^"]+)"' as poluuid
| parse-regexp content, 'policytype="([^"]+)"' as policytype
| parse-regexp content, 'service="([^"]+)"' as service
| parse-regexp content, 'dstcountry="([^"]+)"' as dstcountry
| parse-regexp content, 'srccountry="([^"]+)"' as srccountry
| parse-regexp content, 'trandisp="([^"]+)"' as trandisp
| parse-regexp content, 'duration=([^\s"]+)' as duration
| parse-regexp content, 'sentbyte=([^\s"]+)' as sentbyte
| parse-regexp content, 'rcvdbyte=([^\s"]+)' as rcvdbyte
| parse-regexp content, 'sentpkt=([^\s"]+)' as sentpkt
| parse-regexp content, 'rcvdpkt=([^\s"]+)' as rcvdpkt
| parse-regexp content, 'shapingpolicyid=([^\s"]+)' as shapingpolicyid
| parse-regexp content, 'shaperperipname="([^"]+)"' as shaperperipname
| parse-regexp content, 'shaperperipdropbyte=([^\s"]+)' as shaperperipdropbyte
| parse-regexp content, 'appcat="([^"]+)"' as appcat
| parse-regexp content, 'profile="([^"]+)"' as profile
| parse-regexp content, 'xid=([^\s"]+)' as xid
| parse-regexp content, 'qname="([^"]+)"' as qname
| parse-regexp content, 'qtype="([^"]+)"' as qtype
| parse-regexp content, 'qtypeval=([^\s"]+)' as qtypeval
| parse-regexp content, 'qclass="([^"]+)"' as qclass
| parse-regexp content, 'ipaddr="([^"]+)"' as ipaddr
| parse-regexp content, 'msg="([^"]+)"' as msg
| parse-regexp content, 'cat=([^\s"]+)' as cat
| parse-regexp content, 'catdesc="([^"]+)"' as catdesc
| parse-regexp content, 'crlevel="([^"]+)"' as crlevel
| parse-regexp content, 'crscore=([^\s"]+)' as crscore
| parse-regexp content, 'domainfilteridx=([^\s"]+)' as domainfilteridx
| parse-regexp content, 'domainfilterlist="([^"]+)"' as domainfilterlist
| parse-regexp content, 'app="([^"]+)"' as app
| parse-regexp content, 'logdesc="([^"]+)"' as logdesc
| parse-regexp content, 'cpu=([^\s"]+)' as cpu
| parse-regexp content, 'mem=([^\s"]+)' as mem
| parse-regexp content, 'totalsession=([^\s"]+)' as totalsession
| parse-regexp content, 'disk=([^\s"]+)' as disk
| parse-regexp content, 'bandwidth=([^\s"]+)' as bandwidth
| parse-regexp content, 'setuprate=([^\s"]+)' as setuprate
| parse-regexp content, 'disklograte=([^\s"]+)' as disklograte
| parse-regexp content, 'fazlograte=([^\s"]+)' as fazlograte;