Details
| ID | SonicWallNSv Parsing Rule |
|---|---|
| From Version | 8.2.0 |
Rules (XQL)
[INGEST:vendor="sonicwall", product="ns", target_dataset="sonicwall_ns_raw", no_hit=keep]
// Support only date time of format: yyyy-MM-dd hh:mm:ss. For example: "2021-12-08 10:00:00".
filter _raw_log ~= "time\=\"(\d{4,}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\sUTC\""
| alter timestamp = arrayindex(regextract(_raw_log,"time\=\"([^=]+)\sUTC\""),0)
| alter _time = parse_timestamp("%Y-%m-%d %H:%M:%S", timestamp)
| fields -timestamp;