Details
| ID | HPE_Aruba_ClearPass_ParsingRule |
|---|---|
| From Version | 8.3.0 |
Rules (XQL)
[INGEST:vendor="aruba_networks", product="clearpass", target_dataset="aruba_networks_clearpass_raw", no_hit = keep]
filter to_string(rt) ~= "\d{13}"
| alter _time = to_timestamp(to_integer(rt), "MILLIS");