Oracle Parsing Rule

Parsing Rule

Oracle Database

Details

IDOracle_ParsingRule
From Version6.10.0

Rules (XQL)

[INGEST:vendor="oracle", product="db", target_dataset="oracle_db_raw", no_hit=keep]
filter to_string(EVENT_TIMESTAMP_UTC) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter _time = EVENT_TIMESTAMP_UTC;