Details
| ID | ManageEngine_ADSelfService_Plus_ParsingRule |
|---|---|
| From Version | 8.3.0 |
Rules (XQL)
[INGEST:vendor="manageengine", product="adssp", target_dataset="manageengine_adssp_raw", no_hit=keep]
filter msg ~= "TIME=\d{13}"
| alter time = to_integer(arrayindex(regextract(msg, "TIME=([^\]]+)"), 0))
| alter _time = to_timestamp(time, "MILLIS")
| fields -time;