Rules (XQL)
[INGEST:vendor="okta", product="oag", target_dataset="okta_oag_raw", no_hit=keep]
filter _raw_log ~= "^(\d{4}\-\d{2}\-\d{2})[\s\w]\d{2}:\d{2}:\d{2}\.\d{3}[+-]\d{2}:\d{2}"
| alter
tmp_date_part = arraystring(regextract(_raw_log, "^(\d{4}\-\d{2}\-\d{2})[\s\w]\d{2}:\d{2}:\d{2}\.\d{3}[+-]\d{2}:\d{2}"), ""),
tmp_time_part = arraystring(regextract(_raw_log, "^\d{4}\-\d{2}\-\d{2}[\s\w](\d{2}:\d{2}:\d{2})\.\d{3}[+-]\d{2}:\d{2}"), ""),
tmp_mili_zone_part = arraystring(regextract(_raw_log, "^\d{4}\-\d{2}\-\d{2}[\s\w]\d{2}:\d{2}:\d{2}(\.\d{3}[+-]\d{2}:\d{2})"), "")
| alter
tmp_timestamp_format = concat(tmp_date_part, " ", arraystring(arraycreate(tmp_time_part, tmp_mili_zone_part), ""))
| alter
_time = parse_timestamp("%Y-%m-%d %H:%M:%E3S%Ez", tmp_timestamp_format)
| fields -tmp_date_part, tmp_time_part, tmp_mili_zone_part, tmp_timestamp_format;