feat(addon): Extract all URL Categories to category as a multi-value field

[as3923]

Description

Extract multi-value URL categories from logs that come from Cortex Data Lake. Should also resolve issues similar that mentioned in #147 for logs from Cortex.

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate)

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist

• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes if appropriate.
• All new and existing tests passed.

[welcome-to-palo-alto-networks]

🎉 Thanks for opening this pull request! We really appreciate contributors like you! 🙌

[btorresgil]

Thanks for opening this. How has it been tested?

I'm concerned that isnotnull will always return true because Splunk seems to enjoy populating null json values with a string containing the word "null" which would always be non-null.

I'm also not sure if a split is the right way because I thought CDL would produce a list which should be parsed by Splunk into multi-value field. Curious if CDL is offering a comma delineated string instead of a list.

Thanks again!

[as3923]

@btorresgil This was tested with Cortex data in an on-premise Splunk Enterprise environment.

I'm not concerned about isnotnull for the URLCategoryList field, because the field only exists in the JSON if there is data, otherwise the field does not exist--therefore not populated with "null" like some of the other JSON fields.

I used split to create a multivalue field because that's what was done in #154 for non-Cortex data. If a single comma delineated string is preferred, then use URLCategoryList without the split function.