Details
| ID | MicrosoftExchangeServer_Parsing_Rule |
|---|---|
| From Version | 6.10.0 |
Rules (XQL)
[INGEST:vendor="msft", product="exchange", target_dataset="msft_exchange_raw", no_hit = keep]
filter date_time ~= "\d{2}\:\d{2}\:\d{2}"
| alter _time = date_time;
| ID | MicrosoftExchangeServer_Parsing_Rule |
|---|---|
| From Version | 6.10.0 |
[INGEST:vendor="msft", product="exchange", target_dataset="msft_exchange_raw", no_hit = keep]
filter date_time ~= "\d{2}\:\d{2}\:\d{2}"
| alter _time = date_time;