Prisma Cloud Compute Parsing Rule

Parsing Rule

Prisma Cloud Compute by Palo Alto Networks

Details

IDPrisma_Cloud_Compute_ParsingRule
From Version8.3.0

Source

PrismaCloudCompute.xif PrismaCloudCompute.yml
Download History Raw 
[INGEST:vendor="prisma", product="cloud_compute", target_dataset="prisma_cloud_compute_raw", no_hit=keep]
alter
    tmp_extract_time = replex(arraystring(regextract(to_string(time), ".*\d{2}:\d{2}:\d{2}"), ""), ",", "")
| alter
    _time = parse_timestamp("%h %d %Y %H:%M:%S", tmp_extract_time)
| fields -tmp_extract_time;