Oracle OAM Parsing Rule

Parsing Rule

Oracle IAM

Details

IDOracle_OAM_ParsingRule
From Version8.5.0

Rules (XQL)

[INGEST:vendor="oracle", product="oam", target_dataset="oracle_oam_raw", no_hit=keep]
filter to_string(IAU_TSTZORIGINATING) ~= ".*\d{2}:\d{2}:\d{2}.*"
| alter 
	_time = IAU_TSTZORIGINATING;