Fetching multiple headers

Thanks for the fast response. I suppose HTTP::request and HTTP:collect on HTTP_REQUEST events are not implemented in 9.1.1 which we run here.

 

 

I find myself wishing there was an LTM guide for 9.1 available as there are definitely some features in 9.1 that don't exist in 9.0 and yet reading the 9.2 guide one has to simply experiment to see what works and what doesn't.

 

 

Is there any way to specify a character class or a set of characters to terminate the findstr command? Even the TCP::collect kluge I proposed above won't work properly unless I can specify the findstr term character being either a comma or a space/CR, as I need to retrieve the first IP following the first XFF header and that can be one-per-line or a set of comma-separated values following a single field-name.