Oracle Parsing Rule

[INGEST:vendor="oracle", product="db", target_dataset="oracle_db_raw", no_hit=keep]
filter to_string(EVENT_TIMESTAMP_UTC) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter _time = EVENT_TIMESTAMP_UTC;